On February 9, 2009, a fire and explosion in a seriously overcrowded prison in Honduras resulted in 103 deaths and 25 injuries.  The fire was started from a short circuit from a overheated refrigerator motor, used to store soft drinks for the inmates.  The cell block – which has a capacity of 800 – contained 1960 inmates, their clothing, and their bedding materials.  This provided plenty of fuel for the fire.

We can look at the causes that led to the prisoner deaths in a Cause Map, or visual root cause analysis.  We begin with the impacts to the goals.  The deaths and injuries of prisoners are an impact to the safety goal.  The environmental goal was impacted by the severe prison fire and explosion.  The customer service goal (considering the general population as the “customer” of a government-run prison) was unaffected, as there were no prisoner escapes.  Finally, the property goal was impacted due to damage to the prison.

We can continue the Cause Map by asking “why” questions.  The impacts to the goals were due to a severe prison fire and explosion.  In addition to the fire, the injuries to the prisoners was caused by the prisoners being unable to escape.  Part of the reason the prisoners were unable to escape is because they are in prison, and so precautions against escape are part of the deal.  However, egress from a building that is on fire to a safe location should be part of the procedures of any prison.  In this case, the procedures obviously didn’t work considering the high amount of deaths and injuries (of a total of 186 prisoners in this cell block).  The egress was likely made more   difficult due to severe prison overcrowding.  The prison has a capacity of 800 and contained 1,960 prisoners.  The increase in the prison population is at least partially due to a legislation passed the previous August which mandated a minimum 12-year prison term for gang members.  There are estimated to be more than 100,000 gang members in Honduras.

The heat for the fire was provided by an overheating refrigerator motor.  The fuel was provided by large amounts of clothing and bedding materials – more than usual, due to the prison overcrowding.

Once the causes for the impacted goals have been determined, solutions can be brainstormed.  In this case, prisoner advocates have been long calling for alternatives to jail sentences for gang members.  This would, of course, reduce the prison population.  Another option to reduce prison overcrowding would be to build more prisons.  To reduce the risk of fire, motorized equipment should be kept away from flammable objects, like clothing and bedding.  Last but not least, any facility has to have an effective egress plan in the case of fire or other emergencies.  These procedures are especially important in the case of a prison, where the potential of prisoner escape has to be considered as well as prisoner safety.

To view the root cause analysis investigation, please click “Download PDF” above.  Or click here to read more.

On December 16, 1960, two planes collided about a mile above Brooklyn, New York.  One plane – United Airlines Flight 826 – was in a holding pattern preparing to descend into Idlewild (now John F. Kennedy International) Airport.  The other plane – TWA Flight 266 – was preparing to descend into LaGuardia.  Since both airports serve New York City, they are in fairly close proximity.  The planes, too, were in close proximity – too close, leading to their collision.  In addition to the 84 passengers killed on the United flight (though one would survive for a day) and the 44 passengers killed on the TWA flight, 6 people were killed in the neighborhood of Park Slope, where the United plane landed. 

This incident can be outlined in a Cause Map or visual root cause analysis.  We begin with determining the impacted goals.  First, the 134 total deaths were an impact to the safety goal.  The United flight crash resulted in a fire that affected more than 200 buildings, an impact to both the environmental and property goal.   The liability for the crash was assigned to both airlines and the government, an impact to the customer service goal.  There was another impact to the property goal because both planes were destroyed.  Lastly, the labor goal was impacted due to the rescue efforts of the more than 2,500 personnel who responded to the two crash sites. 

These impacts to the goals occurred when both planes crashed after colliding.  The planes collided after their flight paths brought them into too close of proximity.  The United flight was estimated to be 12 miles outside its holding  pattern when the crash occurred, possibly because the ground beacon was not working.  The controllers at Idlewild were unaware of the plane’s position as planes were not tracked in holding patterns as it was too difficult to identify individual planes.  The planes were unaware of each other.  The visibility was extremely poor due to foggy, cloudy, sleety and snowy weather.  The United plane had lost the ability to use their instruments due to a loss of a receiver.  (The cause is unknown.)  Additionally, the controllers at LaGuardia (who were guiding in the TWA flight) were unable to reach the TWA plane to warn them of the close proximity of the United plane. 

Although comprehensive details are not known about the crash, much of the information used to put together the investigation was obtained from the flight recorder (or “black box”).  This is now a main source of data in aviation accident investigations.  The evidence in this case was used to divide up liability for the accident very exactly – 61% to United Airlines, 24% to the US government and the remainder to TWA.

To view the Outline and Cause Map, please click “Download PDF” above.

At least 11 people have been killed – with 24 still missing – after the cruise ship Costa Concordia ran aground on rocks near the island of Giglio, Italy.  The ship was taken  manually up to 4 miles off course on a route not  authorized by the company.

This incident can be thoroughly examined in a visual root cause analysis built as a Cause Map.  First, we examine the impacts to the goals for this incident.  The confirmed deaths and missing people are a significant impact to the safety goal.   Additionally, the environmental goal is impacted because of the potential for a spill of the 500,000 gallons of fuel still onboard.  The required evacuation of the ship can be considered a customer impact goal.  The loss of use of the ship – estimated to be $85 to $95 million for lost usage in the next year and the decrease in bookings due to concern over the incident can be considered an impact to the production/schedule goal.  The damage to the ship, which was recently built and insured for approximately $575 million, is an impact to the property goal and the rescue and recovery efforts are an impact to the labor goal.

Once we have these impacts to the goals, we can begin an analysis by asking “why” questions.  The impact to the safety goal – dead and missing passengers and crew – were caused by the ship running aground on rocks and  some issues with the evacuation process.  The ship ran aground on rocks because it got too close to the island in a manually programmed unauthorized deviation of the ship’s route, potentially to provide passengers with a better view.  This deviation in route, sometimes called a “fly by”, had been previously authorized by the company.  No crew members questioned the change in route by the Captain, noting that onboard he is solely responsible for the ship.  (Note that with great power comes great responsibility, and the Captain has been charged with manslaughter.)   Although the ship contains alarms meant to warn the crew when the ship goes off-course, these alarms are deactivated when the ship route is manually altered.

There were some issues with the evacuation of the ship, though as the company notes, not due to the evacuation procedure, which was externally reviewed in November.  Rather the issues were caused by the severe list of the ship (it was leaning almost completely to one side), which affects the ability to use the lifeboats.  Additionally, some of the passengers (who had just come aboard) had not yet completed a lifeboat drill.  The drill is required to be performed within 24 hours of boarding the ship and was scheduled for the morning after departure. The grounding occurred just 3.5 hours after departure.

Currently, rescue and recovery efforts continue.  Attempts are being made to remove fuel from the ship, which is in a protected area.  Concern about cruise ships in the area have previously been raised, with some wanting to limit ships that are allowed in the area.  Additionally, both the cruise ship company and the government are reconsidering the timing of lifeboat drills in order to ensure the best results for passengers in issues like these.

To view the Root Cause Analysis investigation, please click “Download PDF” above

In the history of nuclear weapons in the U.S., two accidents (or inadvertent drops) of nuclear weapons have resulted in widespread dispersal of nuclear materials.  These two incidents occurred two years apart, within a week.  The incidents had many similarities: in both cases, a B-52 bomber carrying nuclear weapons was damaged in air during an airborne alert mission and released nuclear weapons, which released radioactive material over a large area.  In both cases, there were significant impacts to the safety, environmental, customer service, property and labor goals.

Palomares: On January 17, 1966, a B-52 and KC-135 crashed during refueling above Palomares, Spain.  The KC 135 exploded, killing the entire crew of four.   The B-52 broke up mid-air, killing three crew members (four more were able to eject) and releasing four nuclear weapons.  Two of the weapons’ parachutes failed, and the weapons were destroyed, releasing radioactive material causing extensive cleanup of the 1,400 contaminated tons of soil and debris.  (Additionally, one of the intact bombs fell into the ocean and was not recovered for three months.) This was the third refuel of the mission and it’s unclear what exactly went wrong, though due to the close proximity required, mid-air refueling is extremely risky.

Thule: A fire began in a B-52 when flammable cushions were stuffed under a seat, covering the heat duct.  Hot air from the engine manifold was redirected into the cabin in an attempt to warm it up, which ignited the cushions.  The crew of the B-52 was unable to extinguish the fire and the pilot lost instrument visibility.  The generators failed (for reasons that aren’t clear), cutting all engine power.  The crew bailed, the plane crashed, and the two weapons were destroyed along with the plane, again releasing radioactive material that led to a four-month cleanup mission.

The causes of these two incidents have one thing in common – both resulted from planes carrying nuclear weapons as part of an airborne alert mission.  Although many safeguards were taken due to the high risk of the missions, extremely serious impacts still resulted.  Thus the decision was made to cancel airborne alert missions.  When the risk is too high, sometimes the only solution is to end the situation resulting in the risk.

We can look at these two incidents together in a Cause Map, or visual root cause analysis.  To view the Outlines,  Timeline and Cause Maps in a three-page downloadable PDF, please click “Download PDF” above.  Or click here to read more.

Rhinoceros, commonly called rhinos, have long been hunted for their horns.  Three of the five species of rhinos are considered critically endangered.  According to the National Geographic News Watch, at least 443 rhinos were killed in South Africa in 2011, a significant increase from 333 the previous year.  South Africa is home to more than 20,000 rhinos, which is over 90% of the rhinos in Africa.  For a little perspective on how significantly the problem has grown, South Africa only lost about 15 rhinos a year a decade ago.

Experts in the field have concluded that the number of rhinos lost through unnatural means, both illegal poaching and the less common legal hunts allowed by the government, will result in a decline in the population of rhinos.

This problem can be investigated by building a Cause Map, an intuitive, visual root cause analysis method.  To begin a Cause Map, the impact to the organizational goals is first determined and then “why” questions are asked to add Causes to the map.  In this example, the major organizational goal being considered is the impact to the environmental.  The environmental goal is impacted because the poaching of rhinos hit an all time high.  This happened because of two things, poachers want to hunt rhinos and the methods in place to prevent poaching are ineffective.

Poachers want to hunt rhinos because the black market value of their horns is extremely high.  They are worth more than gold by weight.  Poachers are able to sell the horns for high prices because consumers are both willing and able to pay huge sums.  There is a strong market for rhino horn because of long standing beliefs that rhino horn has medicinal uses, primarily in Asian cultures.  The number of people able to come up with large amounts of money has also increased with the rise of an affluent middle class in many Asian countries.

The poaching is also increasing because it’s very difficult to prevent it.  The rhinos live in a large, wild habitat.  It’s simply difficult and expensive to patrol and defend such a large region.  The poachers are very well armed because they are backed by international crime syndicates with deep pockets.  It’s a huge challenge for the governments involved to prevent the poaching from occurring.

This problem will likely continue to increase until the demand for the rhino horns starts to decrease.  Modern medical research has concluded that rhino horn has no medicinal value, but as long as people are willing to pay big money for them, someone will find a way to meet that demand.

As an interesting aside, theft of rhino horns from museums has also risen dramatically.  At least 30 horns were stolen from museums this past year.  Click here to learn more.

A recent study by the National Highway Traffic Safety Administration determined that 3,092 people died last year in car accidents that involved distracted driving.  This means that texting and talking on cell phones contributed to one out of every 11 traffic deaths in the US last year.

It’s difficult to compare this number to the findings from previous years because the definition for distracted driving was refined.  The number for 2011 included only the effects of texting and using a cell phone while driving while other non-technological distractions were included previously.

One thing that is clear, the popularity of texting is rapidly increasing.   196 billion text messages were sent in June 2011,  a nearly 50% increase from June 2009.

A Cause Map can be built to investigate this issue.  A Cause Map is a visual, intuitive form of root cause analysis.  To view a high level Cause Map of this example, click on “Download PDF” above. 

One of the causes that contributed to this problem is that people aren’t pulling over when they need to use their cell phones while driving.  There are a number of reasons for this.  The first being, that pulling over is rarely convenient.  Second, people don’t see the need to pull over.  And third, whatever laws might be in place prohibiting distracted driving aren’t effective.

It isn’t clear why people don’t believe they need to pull over.  The study by the National Highway Traffic Safety Administration found that many people don’t think that cell phone usage and texting negatively affect their driving skills.  Many studies have determined that just isn’t the case.  Using a cell phone, either to talk or to text while driving will slow down a driver’s reaction time.   A study by the US Department of Transportation found that sending or receiving a text takes a driver’s eyes off the road for an average of 4.6 seconds.  At 55 mph, a car will travel the length of a football field in that time.

Following these findings, the National Transportation Safety Board (NTSB)  has recommended a nation wide ban on the use of all portable electronic devices, including cell phones.  This would include using a hands-free device to operate a cell phone. The only exceptions to the ban would be use of GPS systems and cell phone use in case of emergency.  Only time will tell what effect the NTSB recommendation has future laws.

On November 22, 2011, a tanker truck spilled a large quantity of roofing asphalt along nearly 40 miles of the Pennsylvania Turnpike.  The spill damaged many vehicles and caused a traffic nightmare as crews worked for hours to clean the mess up.  The timing of this incident was also unfortunate because it occurred on the evening before Thanksgiving, traditionally a very high traffic time.

This incident can be analyzed by building a Cause Map, which is an intuitive, visual method for performing a root cause analysis.  The first step when building a Cause Map is to determine how the incident impacted the goals of the organization.  In this example, the safety goal was impacted because there was potential for car accidents and injuries.  Thankfully, no one was actually hurt, but it is important to note the potential impact in order to fully understand the ramifications from an event.  Additionally, the traffic delays are an impact to the schedule goal.  The customer service goal was also impacted because over 150 cars were damaged by the spill.

Now the Cause Map is expanded by asking “why” questions and adding Causes that contributed to the incident in order to show the cause and effect relationships.  In this example, there was a potential for injuries because more than 150 cars were damaged while driving.  The cars were damaged because they drove onto a spill of wet roofing asphalt.  The asphalt covered the cars and their wheels with thick, sticky goo and many of them undrivable.  The cars drove over the roofing asphalt because a tanker truck had leaked onto the road over a long distance.

The tanker truck was carrying a large load of the roofing asphalt, between 4,000 and 5,000 gallons, so there was a large quantity that could potentially be spilled.  Initial findings indicate that the tanker truck spilled the asphalt because of a leaking valve.  Details on why the valve leaked aren’t yet available, but they can be added to the Cause Map as they are known. 

Another Cause of this incident is the fact that the driver of the truck was unaware that his truck was leaking so he drove almost 40 miles before he stopped and realized that there was a problem.    It was evening when the leak occurred so the driver wasn’t able to see evidence of a leak easily.

Media reports have stated that the driver of the tanker truck will be charged in the incident.  He is facing charges of failing to secure his load and failing to obey a trooper.  The website of the trucking company has posted a statement encouraging affected vehicle owners to file claims though their insurance.

Click on “Download PDF” above to view a high level Cause Map of this incident.

In order for a flight to take off and land safely, many complex mechanical systems have to work for the plane to function properly.  Additionally, pilots need to be properly trained and proficient at their jobs.  Airline processes also have to work in order to smoothly ticket, security screen and board all the passengers.  

The number of things that have to work for a successful commercial airline flight is impressive.  A recent incident highlighted that even the smallest hiccup, a broken bathroom lock for example, has the potential to cause big issues in the complex world of commercial flights. 

On November 18, 2011, a pilot accidentally got locked inside a bathroom just prior to landing at LaGuardia.  This incident almost resulted in an emergency being declared and terrorist alert being issued.  In order to understand this incident, a Cause Map can be built.  A Cause Map is a visual root cause analysis that illustrates the cause and effect relationship between all the Causes that contribute to an event.

In this example, the copilot considered declaring an emergency because the pilot was gone from the cockpit longer than excepted and an unknown man with an accent knocked on the cockpit door.  The copilot was concerned that this might be a potential hijacking attempt.  His concern was caused by the intended destination being NYC and the 9/11 attacks that occurred there 10 years ago.

The pilot was taking longer than normal because the bathroom door lock had jammed when he had tried to exit after a bathroom break.  The unknown man was a well-intended passenger who had heard the pilot calling for help.  The pilot had given him the password to access the cockpit because all other crew members were inside the cockpit.  There were two reasons that all other crew members were inside the cockpit.  First, regulations require that at least 2 crew members are inside the cockpit at all times.  Second this was a small airplane staffed with only 3 crew members.  If the pilot or copilot needed to use the restroom, the only flight attendant had to enter the cockpit to meet the rules.

Luckily, the pilot was eventually able to free himself from the bathroom and return to the cockpit before anything too exciting happened.  The plane landed as scheduled.  The FBI and Port Authority cops met the plane, but after briefly talking to the passenger involved it was quickly determined that nothing suspicious had occurred.

The Department of Transportation (DOT) recently issued the first fine for violating new rules that limit how long passengers can be kept onboard a plane waiting on the tarmac. The new regulations, commonly called the tarmac delay rule, state that passengers may not be kept onboard a plane waiting on the runway for more than 3 hours without being given the opportunity to deplane.  The rules also require that airlines provide adequate food and drinking water for passengers within 2 hours of a plane being delayed on the tarmac and to maintain operable lavatories.  The tarmac delay rul, which went in effect April 2010, was created following several incidents where passengers were kept onboard airplanes for long periods of time.

The incident that resulted in a fine is not the first violation of the 3 hour rule, but this is the first time the DOT has taken the step of issuing a fine.  The potential fees for violating the rules are substantial.  Airlines can be fined $27,500 per passenger when the tarmac delay is beyond 3 hours.  This quickly adds up, especially if multiple flights are involved.  In this example, 15 American Eagle flights were delayed beyond the 3 hour limit  May 29, 2011 at O’Hare International Airport in Chicago.   608 passengers were affected and American Airlines was fined a whopping $900,000.

What happened?  How were so many flights on the tarmac so long?

This example can be analyzed by building a Cause Map, a method for performing a visual root cause analysis.  A Cause Map is built by determining the cause and effect relationships between all the Causes that contributed to an incident.  Click on “Download PDF” above to view a high level Cause Map of this incident.

Like many airline delays, inclement weather played a major role in this incident.  Flights had been delayed taking off from O’Hare and planes that were scheduled to be gone were still sitting at the gates.  Planes that landed had nowhere to go so they sat on the tarmac waiting for an open gate.  Passengers were also not given an opportunity to deplane within 3 hours.  The airline has procedures to get passengers off the planes even if the planes themselves were stuck waiting on the tarmac, but the procedures were not implemented within the 3 hour time limit.  If there was no delay limit, an airline couldn’t violate it so the new creation of the tarmac delay role is also a cause to consider in this incident.

It will also be interesting to see how this large, first of its kind fine affects the airline industry as a whole.   Statistics show that the new rules have successfully reduced long tarmac delays.  The first year that the rule was in effect, airlines reported only 20 tarmac delays of more than 3 hours, but in the 12 months prior to rule there were 693 delays of more than 3 hours.  But this improvement may come at a high cost.  Especially now that the DOT has shown that they are willing to issue fines, industry analysts are warning that a possible unintended consequence of the new tarmac will be more canceled flights.  The fines are so hefty that airlines may cancel entire flights rather than risk violating the tarmac delay rules, which would obviously have an impact on travelers.  Only time will tell how the new rules will affect airline travel.

Hockey fans were devastated when, on September 7, 2011, a Yak-42 plane carrying a Russian hockey team, including many former NHL players, crashed shortly after takeoff.  A total of 44 people were killed, including 36 passengers and 8 crew members.  One crew member survived the crash.  This incident was the 7th fatal crash to occur in Russia since June, and resulted in the loss of the license of the company who operated the plane. 

Now that the Russian air safety organization has released results from its investigation, we can map the details of the crash into a Cause Map, or visual root cause analysis. The Cause Map begins with the impacts to the goals.  The deaths of the crew and passengers are an impact to the safety goal.  The company losing its operating license can be considered an impact to the organizational goal.  The damage to the plane is an impact to the property goal.  All these impacts to the goals were caused by the plane crashing into a riverbank shortly after takeoff. 

We ask “Why” questions to add more detail to the map.  It has been determined that the plane crashed because it had insufficient speed during takeoff, and the takeoff was not aborted.  It is also possible that the pilot was attempting to emergency land in the river, and missed.  The plane had insufficient speed during takeoff because the brake was pressed.  Studies determined that a foot had to be placed on the brake pedal in order for the brake to be activated.  Because of the force being used on the control column, it is likely that one of the pilots was attempting to push down using his foot as a brace.  The pilots who were flying the plane were more familiar (and were being trained simultaneously on) another type of plane.  This plane – the Yak-40 – has a foot rest where the Yak-42′s brake pedal is located.  Normally pilots are only trained on one type of plane at a time to minimize this sort of confusion.

In addition, at some point during takeoff, the engine was idled.  This would normally indicate that takeoff is being aborted.  Once the engine was brought back into service, it took some time to regain takeoff power – and the speed had already dropped.  Aviation experts say that takeoff could have been aborted and the crash would have been avoided.  However, it does not appear that an abort attempt was made.  Flight recordings indicate confusion and a lack of effective communication in the cockpit.  Prior to the engine being idled, one of the pilots pushed the control stick forward, after which it was pulled back to resume takeoff.  The crew on this plane had never trained together before which is fairly typical, and may be part of the reason for the recent poor safety record of planes in Russia.  Additionally, the pilot had Phenobarbital in his system, which is known to slow reaction time.  Recommendations to attempt to improve the safety of small planes of regional carriers in Russia have been under consideration with the recent rash of crashes.  However, the loss of many popular hockey players may increase the urging to implement these solutions.  

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

On October 31, 2011, a bluff collapsed at a power plant on the shores of Lake Michigan.  The resulting mudslide took trailers, storage units, at least one truck and an unknown amount of coal ash into the lake, which provides drinking water for more than 40 million people.  Cleanup is ongoing, but the overall impact to the environment has not yet been determined.  Fortunately, no personnel were in the objects that ended up in the lake, so there were no injures. 

Although the safety goal was not impacted by this incident, there was the potential for personnel injury.  Additionally, the environmental, customer service, property and labor goals were impacted by the pollution of the lake, loss of property and necessary cleanup.  The causes for these impacts to the goals can be examined in a Cause Map, or visual root cause analysis. 

The mudslide which took the objects and coal ash into the lake was caused by insufficient stability of a bluff overlooking the lake.  The bluff’s instability was caused by degraded ground material stability mixed with water and no vegetation.  The vegetation had been removed for construction.  The ground in the area had been filled with coal ash – a practice allowed in previous decades.  Coal ash is less stable than soil, especially when it is exposed to water.  In this case, aerial images suggest that the water seeped into the area from a high water table or from an unlined retention pond used to store storm water.  Although a construction project was ongoing, an environmental impact study – which may have unearthed concerns about the stability of the area – was not considered necessary. 

Steps are being taken to clean up the lake to the extent possible.  However, concerns about coal ash in this area and others are prompting a review by Congress to determine how coal ash can be safely dealt with.  Many say this incident suggests that stronger controls are needed.       

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

BlackBerry faced yet another setback last month when service went down world-wide for multiple days.  The Research in Motion (RIM) company, already facing stiff competition from other smart phone vendors, apologized profusely for the outage and vowed to woo back its customers.  What caused the extensive and possibly business-ending service outage?

A root cause analysis can help identify what occurred.  The first step is to outline the incident.  The service outage originated in Europe, then spread to four other continents over a 72 hour period.  Customers were furious with the service outage and the slow PR response from the company.  This outage impacted two major RIM goals – to generate revenue for shareholders and maintain customer satisfaction.  Working backwards from these goals, the Cause Map shows what events led to the catastrophic failure and where further investigation is needed.

The company faces a potential loss of revenue if it loses customers.  The company may not have had to worry about the impact of such service outages in the past…except that now there are viable alternatives such as Apple and Android devices.  Continuing to work backwards, customers were upset because of a service outage.  At this point, it helps to examine the BlackBerry network architecture.

BlackBerry’s architecture is fundamentally different from that of Apple and Android.  All data is filtered through the company’s internal service network, before being passed on to carrier networks such as Sprint and Verizon.  Apple and Android don’t provide processing in the middle.  When BlackBerry’s core switch failed in an English data center, a backup switch was supposed to take over.  It had been tested successfully.  Unfortunately the backup didn’t work, leading to a buildup of messages waiting to be processed.  That mountain of messages led to backlogs in other data centers worldwide.  When the switch failed, it also corrupted the database software managing all the messages within the network.  

It turns out that this network architecture is both a liability and at the heart of the company’s business success.  By centrally processing all data messages – both compressing and encrypting them – RIM provides additional security and reduces the processing required at the user device, meaning lower energy use and a longer battery life.  Despite these strengths, RIM would be wise to find out why their network crashed.  As users store more data within the network – as with cloud computing – outages could cripple the system for even longer.

Thailand is experiencing an unusually heavy monsoon season, but it’s management of the rains that are being blamed for the most severe flooding to occur in the area in decades.  Heavy rains resulting from the monsoon season and high tides are creating serious difficulties for officials in the area, who are having to make hard choices with where to divert water and are essentially “sacrificing” certain towns because there’s nowhere else for the water to go.  One of these decisions ended in a gunfight.  Tensions are high, and people are busying themselves attempting to protect their homes and towns with hundreds of thousands of sandbags.

We can examine the issues contributing to the risk to people and property in a Cause Map, or visual root cause analysis.  First, we define the problem within a problem outline.  In the bottom portion of the outline, we capture the impacts to the country’s goals.  More than 200 people have been reported killed as a result of the floods, which are themselves an impact to the environmental goal.  If citizens can be considered customers, the decision to “sacrifice” some towns to save others can be considered an impact to the customer service goal.  The  property goal is impacted by the destruction of towns and the labor goal is impacted by the flood preparations and rescue missions required to protect the population.

Beginning with these goals and asking “Why” questions, we can diagram the cause-and-effect relationships that contribute to the impacts discussed above.  The decision to “sacrifice” some towns to save others is caused by flooding due to heavy monsoon rains and high tides, and the fact that water had to be directed towards some towns, as there is nowhere else for the water to go.  Towns have been built in catchments and areas designed to be reservoirs. Natural waterways have been dammed and diverted.  Dams are full because insufficient water was discharged earlier in the season due to a miscalculation of water levels. Canals have been filled in or are blocked with garbage.  Insufficient control of development in the area has led to insufficient control of water flow, and lack of areas for water to gather – without endangering towns.  

Thailand officials are assisting with sandbags and building new flood barriers and drainage canals.  They’re admitting that this issue needs to be repaired.  According to the director of the National Disaster Warning Center, “If we don’t have integrated water management, we will face this problem again next year.”  Hopefully this is the first step in making changes that ensure loss of life and property is minimized during the annual rainy season.          

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more

The racing world was filled with sadness with the death of Dan Wheldon during the Indy 300 race in Las Vegas on October 16, 2011.  However, many race-car drivers were not shocked at the occurrence of a 15-car pileup that resulted in Wheldon’s death.  Specifically, these drivers note that the track – which was designed for NASCAR vehicles which travel at much slower speeds – was designed with high banks that allowed cars to accelerate heavily, reaching speeds of up to 225 miles per hour.  This also contributed to the cars remaining very close together, leaving little time or space for drivers to maneuver.  Although the track was smaller in diameter than other tracks (1.5 mile oval compared to the Indy 500′s 2.5 mile oval), it allowed 4 cars to race side by side, as was happening at the time of the crash.  

Drivers say that the design of the track, the speed of the cars, and the unusually high number of competitors (34, when a full field is generally 26-28 cars) contributed to the crash.  Also, the open wheel design of Indy cars means that the driver has less control when contacting other cars.  In fact, many drivers said they expected at least one spectacular crash to result, given the circumstances.  Although racecars do have special features that protect drivers in a crash, the cars used in the Indy races have open cockpits, providing less protection.  It also appears that the protective roll hoop was missing on Wheldon’s car, though more information on this has not been released.

Other drivers were also injured in the 15-car pileup, though their injuries were not critical and all others have been released from the hospital.  Wheldon was said to have suffered “unsurvivable head injuries”.   After Wheldon’s death, the race – which had a $5 million prize in hopes to boost ratings – was stopped.   This is the first fatality to occur in Indy racing since 2006.  It is hoped that new safety measures – which Wheldon had been involved with – will continue to make Indy racing safer.  However, there are some drivers that believe that regardless of the safety features in the cars, Indy racing should be done on street courses, not ovals.      

To view the Outline and Cause Map, please click “Download PDF” above.

A settlement against an aircraft manufacturer, with regards to a claim that faulty design allowed toxic fumes to enter the cabin, occurred in early October 2011.  It is the first of its kind to occur in the U.S., but may not be the last.  A documentary entitled “Angel Without Wings” is attempting to bring more attention to the issue, which air safety advocates claim has affected the health and job-readiness of some airline crewmembers. 

Although the aircraft manufacturing and operating industries maintain that the air in cabins is safe, breaches are rare, and that the small amount of toxicity that may get into the cabin is not enough to affect human health, the issue is expected to gain more attention, as some industry officials maintain that approximately one flight a day involves leakage of toxic fumes into the passenger cabin of an aircraft.  Although there is debate about the amount of fumes required to cause various health effects, allowing toxic fumes of any amount into a passenger cabin is an impact to both the safety and environment goal.  Additionally, the lawsuit – and the potential of more to come – against the manufacturer is an impact to the customer service goal.  Although the suits have been brought by crew members, there is also a concern for the safety of passengers with respect to exposure to the contaminated air.

The toxic smoke and fumes enter the plane’s air conditioning system when engine air gets into the bleed-air system, which directs air bled from engine compressors into the cabin.  Because there is currently no effective way for crew members to determine that the air is contaminated – no detectors and insufficient training for these crew members to recognize the source and possible outcome of the fumes – the air continues to be fed to the cabin. The creators of the documentary, and other air safety advocates, are requesting that better filters be installed to prevent the toxic fumes to enter the cabin, less toxic oil be used so that the fumes from any leaking oil are less damaging to human health, that detectors be installed in air ducts to notify crew of potential toxicity in the air supply, and better education and training to help crew members identify the potential for exposure to toxic fumes.  However, the manufacturer’s newest design makes all this unnecessary by using an aircraft design that provides air from electric compressors.  Given the length of time that aircraft remain in the air, it will be decades before the system may be phased out.  In the meantime, advocates hope that other corrective actions will be implemented to decrease the potential of exposure to passengers and crew.  

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

In 1982, 31 million bottles of Tylenol were recalled after seven deaths from cyanide poisoning.  After an investigation, higher than lethal doses of cyanide were found to have been inserted into bottles of Extra-Strength Tylenol capsules in retail stores in the Chicago area. Tylenol’s manufacturer, Johnson & Johnson, immediately took action and recalled all Tylenol products.  

Although the reason for the poisoning is unclear – the suspect has still not been caught, though interest in the case has recently been revived – what was clear is that the ability to tamper with a product in such a malicious way without the tampering being evident contributed to the deaths.  As a result of this issue, capsules (which are much easier to insert foreign objects into than solid pills) decreased in use, and tamper-evident packaging became used for many products.  

Although the manufacturing and packaging process were not implicated in the poisonings (the adulterated packages were from different plants, but all came from stores within the Chicago area), there was concern that Tylenol would never again be popularly accepted.  However, Johnson and Johnson’s quick and effective action in the immediate recall of all products and public relations campaigns to urge people not to use products until the issue had been resolved has been considered a playbook on how to conduct an effective recall and is believed to have directly contributed to the resurgence in the popularity of Tylenol shortly after the issue.  (See “How Effective Public Relations Saved Johnson and Johnson“.)

Even though this case hasn’t been resolved, and the killer still remains unknown, it is possible to examine the issue with a Cause Map.  Because this case has stretched over many years, a timeline can help to sort through information.  The outline contains the many impacts to the goals related to the issue, and the Cause Map sorts through causes – both “good” and “bad” – related to the issue.  Solutions implemented to decrease the ability to tamper with consumer products are also noted.

On September 8, 2011, work on a fault capacitor in Arizona began a series of events that resulted in the worst power outage in the Southwest for 15 years.  Although there were no injuries reported as a result of the power outage, there was a high potential for injuries and/or deaths, as hospitals shut down and at least one airport lost runway lighting.  Raw sewage leaked onto beaches and millions found themselves without power.  The economic losses from this incident are reported to be as high as $118 million.  The Federal Energy Regulatory Commission (FERC) will be conducting an investigation to determine how simple capacitor work resulted in an incident with such extreme effects. 

The issues related to this power outage are complicated, and can be more clearly understood in a visual format, such as a Cause Map.  We can examine the cause-and-effect relationships that resulted in the impacted goals discussed above.  The potential for injury was caused by a loss of electrical power to hospitals and airports.   The loss of power was caused by a grid crash, resulting from insufficient power and high demand (at least partially due to a heat wave).  Power stations that normally provide electricity were automatically shut down when a current reverse (normally the current runs from Arizona to California) resulted from the loss of a transmission line resulting from the capacitor work.  Although “operator error” has been mentioned as a potential cause, it’s undesirable that one operator’s error could cause such an extreme power outage.  The system should be designed to prevent this, and the investigation will hopefully address issues in the system that contributed to the extent of the outage.

In addition to losing power stations, insufficient base-load capacity in the area (long a source of concern) meant that standby plants could not be brought up fast enough to prevent the crashing of the grid.  Also, renewable wind and solar energy sources weren’t much help due to less than ideal weather conditions for production (cloudy with low wind). 

The FERC’s investigation will determine causes that contributed to this power outage and will provide recommendations to limit these types of incidents in the future.  Specifically, they will determine what allowed a simple capacitor issue to result in an extensive power outage and will also consider the grid stability in the area.  However, in the meantime, some individual businesses discovered a boon in having their own generators.  Additionally, U.S. Navy ships in port in San Diego used their generators to supply power to the grid.  While these actions certainly helped lessen the effect of the outage (and brought in a lot of business to locations that did have generators), broader improvements are needed to prevent these types of issues in the future. 

To view the Outline and Cause Map, please click “Download PDF” above.

Sad news is nothing new for the National Championship Air Races – there have been 29 deaths associated with the races in its 47-year history.  However, the ten deaths and dozens of injuries (some extremely serious) resulting from a plane crash and explosion on September 16, 2011 have brought attention to the safety of air racing.  

Although full details of the causes of the crash and explosion have not been determined by the National Transportation Safety Board, we can begin a comprehensive root cause analysis with the information available so far by building a Cause Map.  First, we capture the basic details (such as the date and time of the incident) in the Outline.  Then we record the impacts to the goals.  In this case, there was a significant impact to the safety goal, considering the high number of deaths and significant injuries.  The customer service goal can be considered to be impacted because the spectators at the show were not sufficiently protected from injury.  (The FAA grants approval to air shows based on safety of the spectators from a crash.)   The remaining days of the race were cancelled – an impact to the schedule goal.  The plane was destroyed, an impact to the property goal, and the resulting NTSB investigation will cause an impact to the labor goal because of the resources required to complete the investigation. 

Once we have captured these impacts to the goals, we can use them to begin the analysis.  The injuries and deaths occurred from the plane crashing into the VIP section and the subsequent explosion which resulted in shrapnel injuries.  The pilot lost control of the plane and did not have sufficient time to recover (as evidenced by there being no indication that he made a distress call).  It’s unclear what exactly caused the loss of control; however, the plane had been modified to increase its speed, which would have impacted its stability in flight.  Additionally, photos taken just before the crash appear to indicate that a portion of the tail fell off, but the reason why has not yet been discovered.  What happened to the tail section, and how the modifications affected control of the plane, are questions the NTSB will examine in their report. 

Because of the goal of an air race – traveling around a course at low altitudes and high speeds – it’s no surprise that the pilot did not have sufficient time to recover control before crashing.  Given that these conditions are expected during air races – and appear to be an acceptable risk to pilots, who continue to race even with the high number of crashes and fatalities that result – it appears that there needs to be more consideration of how spectators are protected from crashes and the shrapnel that can result from the destruction of a plane. 

When more evidence is gathered, more information can be added to  the Cause Map.  Once that occurs, the NTSB can examine the causes contributing to the deaths at the air race, and make recommendations on how future deaths can be avoided.    

To view the Outline and Cause Map, please click “Download PDF” above.

An explosion at a nuclear waste processing site in France killed one and injured four workers on September 12, 2011.  The investigation is still ongoing, but it is still possible to create a Cause Map, a visual root cause analysis, that contains all known information on the incident.  As more information becomes available, the Cause Map can easily be expanded to incorporate all relevant details.  One advantage of Cause Mapping is that it can be used to document all information at each step of the investigation process in an intuitive way, in a single location.

When the word “nuclear” is involved emotions and fears can run high, especially following the recent events at the Fukushima nuclear plant in Japan.  This incident is a good example where providing clear information can help calm the situation.  The explosion in France happened when a furnace used to burn nuclear waste failed.  The cause of the explosion itself isn’t known at this time, but there is some relevant background information available that helps explains the potential ramifications of the explosion. 

The key to understanding the impact of this incident is the type of nuclear waste that was being burned.  According to statements by the French government, the furnace involved was only used to burn waste with very low level contamination.  It burned things such as gloves and overalls as well as metal waste like tools and pumps.  No objects that were part of a reactor were treated in the furnace.  There are also no reactors at the site that could be potentially damaged by explosion.

There was no radiation leakage detected and the potential for large amounts of released radiation wasn’t there based on the type of material being processed.  It was a horrible accident that resulted in a death and severe injuries, but there was no risk to public health.

How France views nuclear power is also a bit of background worth knowing.  France is the world’s most nuclear power dependent country.  Fifty-eight reactors generate nearly three fourths of France’s power.  France is also a major exporter of nuclear technology.  The public relations issues associated with a nuclear disaster in France would be very complicated.  

Once the investigation into this incident is complete, solutions can complete be determined and implemented to help prevent any future occurrences.

On August 24, 2011, a supply ship heading to the International Space Station (ISS) crashed in Siberia, losing two tons of cargo.  However, the impact of this loss was much more than the two tons of cargo – it may lead to an evacuation of the ISS, which would become unmanned for some unknown period of time. 

The crash of the unmanned Progress 44 supply ship, which was on its way to resupply the ISS, was caused by the emergency deactivation of the Soyuz rocket when a gas generator malfunctioned.   Until the specific causes of the malfunction are determined, manned Soyuz flights are grounded.  That means that a new crew cannot get to the Space Station to relieve the current crew.  Although the current crew has enough supplies for the time being, they cannot remain on the space station past December.  The spacecraft already at the station (their “guaranteed ride home”) are only allowed in space for 200 days – due to limited battery life and concern for degradation of rubberized seals from contact with thruster fuel. 

Because of a lack of funding, American shuttles are now all mothballed, leaving the Russian Soyuz rockets the  only way to and from the space station.  Finding another way to get there by December is unlikely, leaving the attempt to determine and fix the problems with Soyuz the only hope for continued manning of the ISS.  

We can examine this incident in a Cause Map, beginning with the impacts to the goals.  For example, although there were no safety goal impacts resulting from the crash of the unmanned ship, the customer service goal is impacted due to the potential of evacuating the ISS.  The production goal is impacted because of the grounding of manned Soyuz flights, and the property goal is impacted due to the two tons of lost cargo meant for the space station.  We begin our Cause Map with these impacts to the goals, asking “Why” questions to complete the analysis.  The amount of detail in the map is determined by the impact to the goals.  Because the crash may lead to the evacuation and continued unmanned operation of the space shuttle, once specific causes are determined, this Cause Map would become quite detailed.  For now, because the causes have not yet been determined, we begin with a simple map, which does capture the impacts to the goals and the basic information now known. 

To view the Outline and Cause Map, please click “Download PDF” above.

A recent fish kill is estimated to have killed hundreds of thousands of marine life – fish, mollusks, and even endangered turtles – and the company responsible is facing lawsuits from nearby residents and businesses affected by the spill causing the kill.  A paper mill experienced problems with its wastewater treatment facility (the problems have not been described in the media), resulting in the untreated waste, known as “black liquor”, being dumped in the river.  The waste has been described as being “biological” not chemical in nature; however, the waste reduced the oxygen levels in the river which resulted in the kill. 

Although it’s likely that a spill of any duration would have resulted in some marine life deaths, the large number of deaths in this case are related to the length of time of the spill.  It has been reported that the spill went on for four days before action was taken, or the state was notified.  The company involved says that action, and reporting to the state, are based on test results which take several days. 

Obviously, something needs to be changed so that the company involved is able to determine that a spill is occurring before four days have passed.  However, whatever actions will be taken are as of yet unclear.  The plant will not be allowed to reopen until it meets certain conditions meant to protect the river.  Presumably one of those conditions will be figuring out a method to more quickly discover, mitigate, and report problems with the wastewater treatment facility.

In the meantime, the state has increased discharge from a nearby reservoir, which is raising the water levels in the river and improving the oxygen levels.  The company is assisting in the cleanup, which has involved removing lots of stinky dead fish from the river.  The cleanup will continue, and the river will be stocked with fish, to attempt to return the area to its conditions prior to the spill.

This incident can be recorded in a Cause Map, or a visual root cause analysis.  Basic information about the incident, as well as the impact to the organization’s goals, are captured in a Problem Outline.  The impacts to the goals (such as the environment goal was impacted due to the large numbers of marine life killed) are used to begin the Cause Map.  Then, by asking “Why” questions, causes can be added to the right.  As with any incident, the level of detail is dependent on the impact to the goals.

To view the Outline and Cause Map, click “Download PDF” above.

A recent issue at a parts plant in Oregon caused a release of hazardous chemicals which resulted in evacuation of the workers and in-home sheltering for neighbors of the plant.  Thanks to these precautions, nobody was injured.  However, attempts to stop the leak lasted for more than a day.  There were many contributors to the incident, which can be considered in a root cause analysis presented as a Cause Map. 

To begin a Cause Map, first fill out the outline, containing basic information on the event and impacts to the goals.  Filling out the impacts to the goals is important not only because it provides a basis for the Cause Map, but because goals may have been impacted that are not immediately obvious.  For example, in this case a part was lost.  

Once the outline is completed, the analysis (Cause Map) can begin.  Start with the impacts to the goals and ask why questions to complete the Cause Map.  For example, workers were evacuated because of the release of nitrogen dioxide and hydrofluoric acid.  The release occurred because the scrubber system was non-functional and a reaction was occurring that was producing nitrogen dioxide.  The scrubber system had been tripped due to a loss of power at the plant, believed to have been related to switch maintenance previously performed across the street.Normally, the switch could be reset, but the switch was located in a contaminated area that could only be accessed by an electrician – and there were no electricians who were certified to use the necessary protective gear.  The reaction that was producing the nitrogen oxide was caused when a titanium part was dipped into a dilute acid bath as part of the manufacturing process.  

When the responders realized they could not reset the scrubber system switch, they decided to lift the part out of the acid bath, removing the reaction that was causing the bulk of the chemicals in the release.  However, the hoist switch was tripped by the same issue that tripped the scrubber system.  Although the switch was accessible, when it was flipped by firefighters, it didn’t reset the hoist, leaving the part in the acid bath, until it completely dissolved.

Although we’ve captured a lot of information in this Cause Map, subsequent investigations into the incident and the response raised some more issues that could be addressed in a one page Cause Map.  The detail provided on a Cause Map should be commensurate with the impacts to the goals.  In this case, although there were no injuries, because of the serious impact on the company’s production goals, as well as the impact to the neighboring community, all avenues for improvement should be explored.  

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

Rioting is a defined as a violent, public disorder caused by a group of persons.  It is a unique phenomenon in that it is difficult to pinpoint exactly what is going to trigger and sustain a riot.  Social scientists know that there is a tipping point at which participants no longer fear punishment (such as jail) as the number of gatherers increases.  However there are many common contributing factors.  A Cause Map can help sort out what led to this month’s rioting over in the United Kingdom. 

It began on August 4th, following the police shooting of a 29-year old in North London.  The police claimed he was suspected of weapons possession and were attempting to execute a warrant.  During the arrest, the suspect was shot and killed.  However, questions arose regarding the circumstances of the arrest and family and friends came to believe that the victim, Mark Duggan, was unarmed.  This led to a peaceful protest of approximately 120, ending at the police station in Tottenham, North London.  Protestors demanded answers, and police officials seemed unable to satisfy the crowd. 

The crowd lingered while police stalled, and grew as disgruntled local youths began to arrive at dusk.  At this point, things began to spiral out of control.  Why did this unsatisfied, but otherwise quiet gathering turn into a multi-day riot across an entire country? 

According to social scientists, rioting generally occurs when there are certain elements present.  Normally there have to be a lot of people.  There also needs to be a low level of perceived risk that they will be punished for unacceptable behavior.  This perception generally increases as there are fewer law enforcement officers and also as there are more people.  Those people generally are upset about something.  There also needs to be a feeling that others are likely to join in.  But even with all these elements, a riot will not start.  The final element is a “catalyst”.  This is typically a person who has calculated that the risk of being targeted by law enforcement is sufficiently low, and acts out – such a throwing a rock through a window. 

Examining the Cause Map reveals that these elements were present in the initial riot as well as in the general rioting that broke out across the country.  It becomes evident that the rioting was cyclical – the initial riot led to more widespread rioting.  And the same elements that were present in the initial riot were present in the widespread rioting as well. 

After completing the Cause Map analysis, the next step is to determine how to prevent this from happening again.  Everyone seems to have an opinion on what went wrong, and more importantly what needs to be done differently to prevent such costly and dangerous behavior.  Resorting back to the Cause Map, we can look for opportunities to prevent future riots.  Some of the elements that contribute to a riot can be controlled more easily than others.  For instance it is easier to limit mass gatherings than control the emotions of a crowd.  Hence, greater police presence and an ability to clear the street – through curfew or quick arrests – are usually the best solutions for limiting riots.  A table of proposed solutions completes the analysis.

In our previous blog about Greece’s economic woes, we looked at some of the impacts the recent events have had on Greece and potentially the rest of the European Union (EU) and a timeline of the events that are part of the ongoing economic crisis.  However, we stopped short of an analysis of what contributed to these impacts.  

The outline, which we filled out previously, discusses an event or incident with respect to impacts to the goals of a country (economy, company, etc.).  An analysis of the causes of these impacts can be made using a Cause Map, or visual root cause analysis.  To do so, begin with one impacted goal and ask “why” questions to complete the analysis.  For example, Greece’s financial goal is impacted because its debt rating is just above default.  Why? Because the ratings agencies were concerned with Greece’s ability to repay.  Why? Because their debt to revenue ratio is too high.  

Whenever you encounter a situation where a ratio is too high – such as this case, where debt is too high compared to revenue – it means that the Cause Map will have two branches.  Each part of the ratio is a branch.  In this case, if debt to revenue is too high, it means that debt is too high and revenue is too low.  Each branch can be explored in turn.  There have been cases made that only one or the other branch is important, but what we’re looking for in a Cause Map is solutions that can help ameliorate the problem.   Due to the severity of the issue in Greece, solutions that reduce debt and solutions that increase revenue must both be implemented in order to attempt to repair the financial standing.  

Greece’s government debt is high – caused by government spending on borrowed money when the euro was strong and interest rates were low.  There are many parts to government spending, which can make their own Cause Map.  Suffice to say, reducing government spending – by a lot – is necessary to reduce the debt to revenue ratio.  Unfortunately, severe reductions in government spending also mean reductions in government services, and government salaries.  As an example, government workers, which total 25% of the total workforce, are seeing their pay reduced 10%.  As you can imagine, this reduced spending has angered some Greeks, causing riots, which have killed Greek citizens.  In this case, the solution “reduced spending” also becomes a cause in another branch of the Cause Map.  It’s important to remember that not all solutions are free of consequences and that solutions themselves may contribute to the overall problems. 

Greece’s revenue is insufficient to fuel their current spending levels.   Tax revenue is decreased by tax evasion, high unemployment, and a shrinking economy.  The Cause Map isn’t simple here either, because the shrinking economy contributes to the unemployment rate, and decreased spending can result in decreased revenue.  The worldwide economic woes are contributing to the shrinking economy, but also low levels of foreign investment, caused by what is considered a difficult place to do business due to political, legal, and cultural issues.  Last but not least, many governments in Greece’s situation would devalue their currency in order to regain an economic edge.  However, Greece uses the Euro – so devaluing currency isn’t an option.  There has been some talk of Greece dropping the Euro but a bailout by the other EU countries (itself an impact to the goals) appears to have shelved that discussion for now.

In addition to reduced tax revenue, Greece is having trouble borrowing money.  As their credit rating has fallen (it now has the lowest credit rating in the world), interest rates for loans are climbing, so it is possible that Greece will still fall into bankruptcy and loans will not be repaid. This is caused by the debt to revenue ratio, and adds a circular reference to our map.  This is why the economic issue has been described as a spiral – the causes feed into each other, making it difficult to climb out.

However, Greece has made admirable strides to attempt to reduce their debt and increase their revenue.  Only time will tell if that, and the bailout from the EU, will be enough.

It is rare for the conduct of the investigation to be one of the biggest headlines in the week following an accident, but this has been the case after a recent train crash in China.  On July 23, 2011, two trains collided in Wenzhou, China, killing 39 and sending another 192 people to the hospital.

What appears to have happened is that a train moving at speed rear ended another train that had stalled on the tracks. It was announced that the first train had stalled after a lightning strike.  Soon after the accident, people reported seeing the damaged train cars broken apart by back hoes and buried.  Meaning the evidence was literally being buried without ever having been thoroughly examined.  The Chinese government stated that the cars contained “State-level” technology and were being buried to keep it safe.

The internet frenzy and public outrage fueled by how this investigation was handled was impressive. According to a recent New York Times article, 26 million messages about the tragedy have been posted on China’s popular twitter-like microblogs.  So powerful has the public outrage been that the first car from the oncoming train has been dug up and sent to Wenzhou for analysis.

More information  on the technical reasons for the train crash is slowly coming to light.  Five days after the accident, government officials have stated that a signal which would have stopped the moving train failed to turn red and the error wasn’t noticed by workers.  There is talk about system design errors and inadequate training.

It’s unlikely that all the details will ever be public knowledge, but there is one takeaway from this accident that can be applied to any organization in any industry that performs investigations – the importance of transparency. The Chinese government spent over $100 billion in 2010 expanding the high speed rail system, but if people don’t feel safe riding the rail system it won’t be money well spent.  Customers need to feel that an adequate investigation has been performed following an accident or they won’t use the products produced by the company.

To view an initial Cause Map built for this train accident, please click on “Download PDF” above.  A Cause Map is an intuitive, visual method of performing a root cause analysis.  One of the benefits of a Cause Map is that it’s easily understood and can help improve the transparency of an investigation for all involved.

Greece is currently suffering from an economic crisis.  Leaders in Greece, the European Union, and the rest of the world are all anxiously watching as events unfold to attempt to minimize the impact of these issues.  An analysis of this issue can help these leaders minimize their own impacts, as well as provide appropriate aid to Greece.  However, performing an root cause analysis on an issue whose roots reach back years is not an easy task.  

Normally a root cause analysis performed as a Cause Map begins with a problem outline.  However, sometimes an issue is so complicated that it’s difficult to begin there.  In these kinds of cases, beginning with the creation of a timeline may aid in the investigation. 

What to include in the timeline is a frequently asked question.  When beginning a timeline, put in all the information you have.  It may make sense to go back later and create a less detailed timeline.  However, many events that don’t initially seem to add much to the timeline may later turn out to be important in the analysis.  In the case of Greece, I began the timeline with Greece’s entry into the European Union (EU).  While it wasn’t clear initially whether this contributed to the current issues being faced by Greece, it later became clear that the restrictions placed on EU-member countries did in fact contribute to the current issues. 

Events in the timeline may turn out to be impacted goals.  For example, at various points in the timeline Greece’s credit rating has been downgraded.  The last downgrade occurred just before default by Moody’s.  Having a solid credit rating is an important goal – so a downgraded credit rating, especially one as low as Greece’s, is an impact to the financial goal of that country.  

Once the timeline has begun (it’s not really complete until the issue is considered resolved, which in this case will take years), the next step would be to tackle the outline.  Writing the timeline will hopefully have provided some clarity to the issue.  For example, since Greece entered recession in 2009, we can choose 2009-2011 as a logical time to enter in the outline.  If more detail is desired, referring to the timeline is also appropriate. 

The most commonly asked question about the outline is what to write in the “differences” row.  Differences are meant to capture things that may have been out of the ordinary, or potentially answer the question “why this country (or equipment or time) as opposed to some other country?”  Because Greece is a part of the European Union, which has consistent financial goals for its members, we can use some data points that show how Greece differs from other countries in the EU, or essentially answer the question “why is Greece having these issues instead of the other EU countries?”  In Greece, debt is estimated to be 150% of the Gross Domestic Product (GDP).  This is much higher than for most other nations.  The public sector in Greece accounts for about 40% of the GDP, also higher than typical.  Greece has the second lowest Index of Economic Freedom in the EU, which impacts its ability to quickly adjust to economic changes.   Greece economic statistics were (significantly)   misreported, contributing to the rapid decline in stability.  And, Greek tax evasion is estimated at 13B Euros a year.  This is likely not a full list of the differences between Greece and other EU countries, but it’s a start  and the outline can continue to evolve as more information is provided on the issue. 

Once the top portion of the outline is complete, the impacts to the goals can be addressed.  Again, many of these impacts can be pulled from the timeline.  There were some citizen deaths associated with rioting as a result of proposed economic policies, which is an impact to the safety goal.  Spending cuts and tax increases impact the customer service goal (in this case, the “customers” are the citizens of Greece).  The production goal is impacted because of high (above 16%) unemployment, and the financial goals are impacted by a debt rating just above default and a 110B euro default.  Last but not least, there is the potential for impact on the European Union if the crisis spreads beyond Greece.  

As you’ve noticed, no real analysis has yet taken place.  We’ll look at some of the causes contributing to the      current issues in Greece in an upcoming blog.  Click on “Download PDF” above to view the timeline and outline

At first glance, it might appear to be a welcome story.  After years of decline in the housing market, there has been a significant dip in foreclosure filing rates.  However the real reason behind the dip isn’t economic recovery…it’s a backlog of work at banks across the nation.  A visual Cause Map helps illuminate what is really going on. 

Foreclosure filings have dropped 25% in the last six months of 2010.  This normally would mean that fewer properties require foreclosure.  Banks usually notify homeowners within days of the first missed payment.  After multiple missed payments, the Notice of Default is finally sent to the homeowner, about 2 months after the initial missed payment. If the homeowner doesn’t pay up, that’s followed soon after by a foreclosure filing.  In most states, eviction can happen in as little as 120 days. 

However in today’s economy, banks are slower to take on new foreclosures.  One of the major causes – a huge backlog of vacant properties – has made banks reluctant to notify newly delinquent homeowners.  The initial notification process has slowed down, but so has the entire foreclosure process.  Banks hope that by delaying the process, homeowners may be able to resume payment – the preferred outcome.  In some states, foreclosures are averaging well over 900 days.  Banks are in the business of managing money, not property.

There’s another reason behind the processing delays.  Last fall banks were brought to court for robo-signing, a practice where law firms were automatically signing off on all foreclosure paperwork.  The practice meant that many applicants were illegally kicked out of their homes.  Many of the largest banks and lenders suspended processing to determine how robo-signing was occurring and stop it.  It turns out that law firms, in an effort to get through the mountains of paperwork, were rubberstamping the foreclosure filings without due diligence to ensure everything was in order.

Delayed foreclosures are beneficial to families facing eviction, however often it is simply delaying the inevitable.  Many economists believe that the economy will continue to struggle until the housing market recovers.  In the meantime, the foreclosure crisis will drag on until banks can close out these dysfunctional loans.

A small Rhode Island town is on the brink of financial disaster.  A low tax basis and mounting liabilities are leaving Central Falls with few options short of filing for bankruptcy protection.   The town has requested financial assistance from state and federal governments and is begging pensioners to accept lower benefits.  But how did they get to this point, and what can be done to keep neighboring towns – and the state itself – from bankruptcy?  A Cause Map visually shows how this occurred. 

Like other towns facing financial difficulty, Central Falls accepted more debt than they are now able to pay.  This two-fold reason is at the center of the Cause Map.  All of the effects Central Falls now faces – such as closed town services and the loss of local jobs – stem from the fact that the city had to cut spending.  The city had to cut spending because it is facing bankruptcy.  The Cause Map method allows us to trace the reasons back even further and build a complete picture. 

The first piece is that the town has a large debt – $80M to be exact – in pension liabilities for its 214 city police officers and fire fighters; this is in addition to $25M in budget deficits over the next five years.  The generous pensions can be traced back to two state laws regarding public worker negotiations.  Rhode Island is one of the few states that allows workers unlimited collective bargaining, meaning that workers can negotiate for a higher salary for any reason.  Without any limits, talks often broke down.  When talks broke down arbitrators stepped in, and their decisions were binding.  In past years, arbitrators often settled on benefits that were comparable to surrounding towns instead of what the city could actually afford.  Unlimited collective bargaining and binding arbitration together contributed to the poor negotiations and overly-generous benefits.

 The second piece is that the town doesn’t have a large income.  It has a small tax basis since the median family income is only around $33,000.  Other sources of income have been pulled back as well – like state and federal funding.  The state is facing similar issues, and is in no place to bail out the multiple municipalities at risk.  The federal government had extended aid, but rescinding it when Central Fall’s credit rating was downgraded by Moody’s.  

Municipal bankruptcy is a rare occurrence, with fewer than 50 occurring in the last 3 decades nationwide.  State bankruptcy is practically unheard of.  Arkansas was the last to default on its bonds, following the Great Depression.  This is in part to bankruptcy laws put in place after to avoid such an occurrence.  When one town goes bankrupt, neighboring communities are often negatively affected.  The resulting domino effect could be disastrous.  Rhode Island is a small state with little room to maneuver if local towns – like Central Falls – start going bankrupt.

The largest solar flare in recorded history occurred on September 1, 1859.  As the energy released from the sun hit the earth’s atmosphere, the skies erupted in a rainbow of colored auroras that were visible as far south as Jamaica and Hawaii.  The most alarming consequences of this “Carrington Event” (named for solar astronomer Richard Carrington who witnessed it) were its effect on the telegraph system. Operators were shocked and telegraph paper caught fire.

No solar flares approaching the magnitude of the Carrington Event have occurred since, but the question must be asked – What if a similarly sized solar flare happened today? 

There is some debate on how severe the consequences would be, but the bottom line is that modern technology would be significantly impacted by a large solar flare.  When large numbers of charged particles bombard the earth’s atmosphere (as occurs during a large solar flare), the earth’s magnetic field is deformed.  A changing magnetic field will induce current in wires that are inside it resulting in large currents in electrical components within the earth’s atmosphere during a solar fare. 

Satellites would likely malfunction, taking with them wireless communication, GPS capabilities and other technologies.  This would severely impact the modern world, but the largest impact would likely be to the power grid.  There is debate on how long power would be out and how severe the damage is, but it is clear that solar flares have the ability to significantly damage the power grid.  Solar flares much smaller than the Carrington Event have caused blackouts, but power was returned relatively quickly.  One of the more impressive of these examples occurred in 1989 when the entire province of Quebec lost power for about 12 hours. (Click here to read more.)

NASA works to predict and monitor sun activity so that preventive actions can be taken to help minimize damage if a large solar flare occurs.  For example, portions of the power grid could be shut down to help protect against overheating.  Scientists continue to study the issue, working to improve predictions for sun flare activity and learn how to better protect technology from them.  Click the “Download PDF” button above to view a high level Cause Map, a visual root cause analysis, built for this issue.

More information can be found in a report by the National Academy of Sciences, Severe Space Weather Events–Understanding Societal and Economic Impacts and the NASA website.

Record flooding has struck along the Souris River, leading to record-breaking flooding in Minot and threatening multiple other towns.  The river has widely ranging annual flow rates, varying from 4,200 acre feet to 2.1M acre feet.  Flooding is not uncommon in this part of the country, but what is striking about this case is how events upstream contributed so dramatically to what happened in Minot. 

Rivers have always flooded.  Snowmelt and spring rains naturally contribute to higher flow rates.  Rivers also naturally move, as soil erodes in places and builds up in others.  As communities have developed near rivers, a need arose to control the rivers’ boundaries.  After all, you didn’t want to have your farm land constantly submerged by water.  Civilizations have been using earthen structures – like levees or dikes – for thousands of years to control the flow of water. 

It was only within the last century, that extensive man-made levees have been built within the U.S.  The levees along the Mississippi River are some of the most elaborate in the world, extending 3,500 miles.  Along with levees, dams help to regulate the flow of water.  Dams can create artificial lakes used either to prevent flooding downstream or to provide a source of water for the community.  

How is all of this relevant to the flooding in Minot?  A visual Cause Map can shed light on what led to the intense flooding there.  For starters, the levees meant to keep the Souris River contained were both overtopped and breeched.  This occurred because there was a high volume of water flowing downstream over an extended period of time.  Why is that?

 The Souris River actually begins in Saskatchewan, where a further series of levees and dams controls the river.  Southern Canada had a significant amount of snowmelt and spring precipitation, saturating the soil and filling up local lakes and man-made reservoirs.  The area also had a heavy amount of rainfall the preceding the weekend, 4 to 7 inches.   With reservoirs already filled, officials had no choice but to increase dam flow rates to prevent flooding or worse – a burst dam. 

While these complex levee and dam systems usually provide stability for riverside communities, they also can work against some of the systems that evolved in nature to keep water flow in check.  For instance, natural levees develop as rivers periodically overflow and deposit silt.  Also everglades and marshlands act like a sponge absorbing excess water.  Human development has affected these natural processes, and unfortunately there are likely to be many further effects from the flooding as the water continues down the Missouri River Basin.

Since May, at least 31 people have died and nearly 3,000 have been sickened from E.coli infections in Europe in one of the widest spread and deadliest E.coli outbreaks in recent memory.  After days of confusion, German authorities determined that the source of the contamination is sprouts from an organic farm in northern Germany. The farm has suspended sale of produce and won’t reopen until it is determined safe. 

This issue can be investigated by creating a Cause Map, an intuitive format for performing a root cause analysis.  In a Cause Map, the causes contributing to an incident are determined and organized by cause-and-effect relationships.  To view a high level Cause Map of this incident, please click on “Download PDF” above.

This investigation is still underway and additional information can easily be added to the Cause Map as it becomes available. The initial source of contamination at the farm had not yet been determined, but sprouts are known have a high risk of carrying dangerous bacteria.

Sprouts are considered to be a high risk food for a number of reasons.  The seeds are often grown in countries with less stringent inspection criteria so they can arrive at growers already contaminated. Seeds can be contaminated in any number of ways.  E. coli live in the gut of mammals so any time animals or animal waste are near sprout seeds there is a chance of contamination.

It can also be difficult to sanitize the seeds.  Bacteria can hide inside damaged seeds and be missed during sanitizing steps.  Sprouts are also grown in warm water, ideal conditions for growing bacteria as well.  Another factor to consider is that many people eat sprouts raw; cooking would kill any bacteria that were present.

Sprouts have been the source of many bacteria outbreaks in the past.  The U.S. has had at least 30 reported outbreaks related to sprouts in the last 15 years.  Sprouts are associated with enough risk that the Food and Drug Administration has issued warnings for those at high risk, (children, the elderly, pregnant women and people with compromised immune systems) to avoid eating raw sprouts.  If you fall into the high risk category or are just feeling nervous after recent events, the easiest way to prevent bacterial infection from sprouts is to cook them.

When Line 132 ruptured last September in the community of San Bruno, California, emergency personnel were quick to respond to the natural gas explosion.  The first fire truck was on scene within six minutes of the explosion.  What responders found was a chaotic scene, with multiple wounded and killed and swaths of the neighborhood in flames or simply flattened.  Little did they know that a large natural gas transmission line, feeding the spreading fire, was directly beneath them.  Emergency personnel did their best to clear homes and evacuate the wounded as the fire spread, but the confusion continued for nearly 90 minutes until the gas valves were shut off upstream from the fire.  

The subsequent National Transportation Safety Board (NTSB) investigations focused on Pacific Gas and Electric (PG&E) processes following the accident, and found that PG&E was woefully unable to respond quickly to a crisis of this magnitude.  As a set of timelines show, emergency response personnel were already on scene long before PG&E was even aware that a pipeline rupture may be associated with a local fire.  PG&E apparently did not notice an alarm warning them of a pressure drop.  Control systems detected a severe pressure drop approximately four minutes after the disruption; however the PG&E gas control center, located in San Francisco, remained unaware of the explosion and fire until a PG&E dispatch center in Concord called them.  Off duty employees had called-in to the Concord dispatch center 7 and 11 minutes after the incident, alerting them of a large fire in San Bruno.  However it was not until the dispatch center called the gas control center 16 minutes after the explosion that gas control operators realized what was happening.  By this point emergency responders had already arrived at the scene, unaware of the large natural gas pipeline directly under the neighborhood.

What information did emergency responders have as they arrived on scene that day?  Although PG&E itself was aware of the likely service disruption, they failed to notify first responders of any potential danger in those critical minutes after the explosion.  Additionally according to NTSB testimony, the fire department was unaware of the large natural gas pipeline under the community.  Larger transmission pipelines have different operating characteristics than smaller distribution pipelines, including different recommended safety precautions and shut down times.  With a better awareness of the pipeline locations and associated dangers, emergency response personnel could have developed training and response procedures ahead of time for an explosion of this magnitude.  PG&E has since taken steps to enhance its partnership with first responders and other public safety organizations.  Clearly there are other steps that need to be taken as well.

When conducting an investigation, a timeline can be a helpful tool to organize information.  While straightforward to build, timelines can identify areas needing more research and aid in building a process map and a Cause Map.  Compare what happened at PG&E to what emergency responders were doing.  You’ll notice there was a significant delay at PG&E in recognizing there was a problem and then acting upon it.  It took nearly 90 minutes to close valves to shut transmission lines.  Changes must be made to speed up PG&E’s procedures in a crisis situation.

Likewise process maps are a useful tool for determining where a process can use improvement.  In the Current process map, it is noticeable that there are three parallel processes occurring, where information is not being shared in an efficient manner.  The PG&E Dispatch Center only shares information with the Emergency Dispatch Center after they have fully assessed the situation.  This information might come after the fact, as it did in San Bruno, or seriously delay an effective response by EMTs and firefighters.  Going one step further, trained emergency personnel might be able to check with local utilities if they have reason to suspect a natural gas pipeline is involved.  Simple procedural changes, such as who is notified and when, can have significant impacts.

It is important to note that the timeline helps create the most accurate “As Occurred” process map (called Current in this case).  Procedures can differ from actual processes, so it is important to document what actually happened, identify differences in what should have occurred, and figure out why it didn’t.  In this case, PG&E’s procedures were followed and need to be revised.

The NTSB recommendations will undoubtedly lead to multiple changes.  It is easy to focus on material solutions, which tend to be expensive to implement.  Some changes under consideration are the use of remote controlled valves and the replacement of aging pipes.  While there is no doubt that these changes need to happen, other changes can help in the meantime.  Process maps can help identify procedural changes which may be much less expensive, such a modifying notification procedures. 

A detailed Cause Map built after the preliminary investigation shows what NTSB investigators believe led the natural gas leak.  More information on the NTSB investigation can be found here.

On June 6, 1889, a cabinet-maker was heating glue over a gasoline fire.  At about 2:30 p.m., some of the glue boiled over and thus began the greatest fire in Seattle’s history.  We can look at the causes behind this fire in a visual root cause analysis, or Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. 

First we begin with the impacts to the goals.  There was one confirmed death resulting from the fire, and other fatalities resulting from the cleanup.  These are impacts to the safety goal.  The damage to the surrounding areas can be considered an impact to the environmental goal.  The fire-fighting efforts were insufficient; this can be considered an impact to the customer service goal.  Loss of water and electrical services is an impact to the production goal, the destruction of at least 25 city blocks is an impact to the property goal, and the rebuilding efforts are an impact to the labor goal. 

Beginning with these impacted goals, we can lay out the causes of the fire.  The fire did so much damage because of the large area it covered.  It was able to spread over downtown Seattle because it continued to have the three elements required for fire – heat, fuel, and oxygen.  The heat was provided by the initial fire, oxygen by the atmosphere, and plenty of fuel with dry timber buildings.  The weather had been usually dry for the Pacific Northwest, and most of the downtown area had been built with cheap, abundant wood.  

Additionally, fire fighters were unable to successfully douse the flames.  The all-volunteer fire department (most of whom reportedly quit after this fire) had insufficient water – hydrants were only placed at every other block, and the water pressure was unable to sustain multiple fire-fighting hoses.  Additionally, some of the water piping was also made of wood, and burned in the fire.  Firefighters attempted to pump water from the nearby bay, but their hoses were not long enough. 

Before spreading across the city, the fire spread across the building where it began.  The fire began when glue being heated on a gasoline fire boiled over and lit.  The fire then began to burn the wood chips and turpentine spilled on the floor.  When the worker attempted to spray water at the fire, it only succeeded in spreading the lit turpentine, and thus the fire.  When firefighters arrived, the smoke was so thick that they were unable to find the source of the fire, and so it continued to burn.

The city of Seattle instituted many improvements as a result of this fire.  Wood burnings were banned in the district, and wood pipes were replaced.  A professional fire department was formed, and the city took over the distribution of water.  Possibly because of the vast improvements being made (and maybe because of the reported death of 1 million rats in the fire), the population of Seattle more than doubled in the year after the fire.  

View the Cause Map by clicking on “Download PDF” above

2011 is on pace to be the worst tornado season since record keeping began in 1950.  Communities nationwide have been affected this year, not just those in “Tornado Alley” where twisters are most commonly found.  The marked increase has many wondering just what is going on.  Is it simply greater media attention?  Or perhaps just bad luck this year?  Or maybe this is all because of global warming…  

Weather experts agree that it is a combination of factors, but nothing out of the ordinary.  Weather is cyclical, and a higher number of deadly tornados than usual have touched down this year.  Currently 52 deadly tornados have already struck, compared with an annual average of 22.  Additionally these tornados happen to have stuck heavily populated areas.  As recent as April of this year, the EPA has stated that “to date, there is no long-term evidence of systematic changes in [thunderstorms and tornados] over the course of the past 100 years.” 

However, some contend that the higher number of tornados must be tied to climate change.  They argue that all the extra energy being stored in the atmosphere is being “expressed in stronger winds…in stronger rainfall.”  How else would it be possible to explain the catastrophic natural phenomenon occurring the last few years?

This is where the Cause Mapping process can help focus all parties on solving the problem, instead of arguing or blaming.  The first step in the process is to define the issue by its impact to overall goals.  In this case, all parties can agree that the destruction and loss of life are the principle impacts.  

The next step is to analyze the causes in a visual map.  A simple Cause Map can lay the foundation for a more detailed analysis, so a 5-Why map is usually the best starting point.  From there more causes can be added to the map; all possibilities should be included on the first draft.  When all possible causes are included, it focuses on team on brainstorming instead of debating. 

Let’s take a closer look at why so many tornados have hit densely populated areas.  There are primary four reasons identified in the Cause Map.  First, there have been more tornados.  This could be because more are being counted, due to better weather tracking capabilities, or because there simply are more occurring.  Second, there are more forceful tornados than usual.  This could be related to more supercell thunderstorms, since most tornados spring from these types of weather systems.  Because this isn’t known for sure, a question mark indicates that more evidence is needed to support or disprove this hypothesis.  Likewise, it’s possible more strong weather systems are being caused by global warming.

Instead of stopping the analysis to debate global warming, it’s most productive to continue exploring why tornados are touching down in population centers.  It’s not simply a function of the tornados.  There also happen to be more people near where tornados are, and there are more structures which are susceptible to tornado damage. 

More people are near where the tornados are because there are more people.  While this is straightforward, it’s often overlooked in the debate and is precisely a reason why more people would perish in a tornado.  People might also be in the area because they have little time to evacuate or take appropriate shelter, unlike in a hurricane.  Advance warning averages just 11 minutes.  

Despite many advances in Doppler radar technology and satellite data, tornados are still generally detected the old fashioned way.  Today, a web of 290,000 trained volunteers, called SKYWARN, provide severe weather alert information to the National Weather Service.  Since its inception in the 1970s, SKYWARN has helped the NWS to issue more timely and accurate severe weather warnings.  The NOAA’s National Severe Storms Lab is looking to improve that advanced warning time to 20 minutes, so this might be a possible solution to reducing the number of deaths and injuries caused by tornados.  

The fourth factor is that people tend to be located in buildings which are highly susceptible to tornado damage.  More Americans are living in manufactured or modular homes than in previous decades.  As of 2009, there were 8.7 million mobile homes in the United States.  Mobile homes account for nearly half of tornado fatalities.  When other factors are normalized, the data shows unequivocally that mobile homes are more likely to sustain catastrophic damage during tornados.  Some states have begun to take steps to improve the building codes for such dwellings and also to require hardened shelters at mobile home sites. 

As even this fairly simple Cause Map demonstrates, there are many factors contributing to this season’s frightening weather.  Focusing on a single cause can mask the many reasons required to produce an effect, and in the end only limits productive debate.

The very existence of climate change continues to be controversial, but some cities have already decided to start preparing for a hotter future.  While the rest of the world continues to debate whether man’s impact on the world is producing climate change, the city of Chicago is already taking action to prepare for a warmer climate. 

The effort to adapt Chicago to the predicted climate of the future began in 2006 under the then mayor Richard M. Daley.   The first step in the process was a model that was created by scientists specializing in climate change to predict how global warming would affect Chicago.  The output of the model shocked city planners.  Experts predicted that summers in Chicago would be like current summers in the Deep South, with as many as 72 days over 90 degrees by the end of the century.  A private risk assessment firm was tasked to determine how the predicted climate shift would impact the city.  The dire predictions included an invasion of termites, heat-related deaths reaching 1,200 a year and billions of dollars’ worth of deterioration to building and infrastructure in the city.  Chicago decided the time to take action was now. 

Created by Robert A. Rohde as part of the Global Warming Art project.

Armed with the predictions, city planners began to plan how best to adapt Chicago for the warmer future.  There are a number of ways that Chicagoans are already changing how they maintain the city.  Much attention has been given to the paved spaces in the city to improve drainage to accommodate higher levels of predicted rain.  13,000 concrete alleys in Chicago were originally built without drainage and city planners are working to change this.  150 alleys have already been remade with permeable pavers that allow 80 percent of rainwater to filter to the ground below.  City planners are also changing the mix of trees that are planted to make sure they are selecting varieties that can withstand hotter temperatures.  Air conditioning is also being planned for Chicago’s public schools, which have been heated but not air conditioned until now.

Time will tell whether the steps Chicago is taking will prove necessary, but the Chicago’s adaption strategy is an interesting case study in a nation still debating the existence of global warming. 

When trying to select the best solutions to a problem such as in this case, the Cause Mapping method of root cause analysis can be an effective way to organize all the information.  A Cause Map detailing the many causes of a problem may make it easier to select the most cost effective and efficient means of preventing a problem.  A Cause Map can also be adapted to fit the scope of the problem.  In this example, a Cause Map could be built to detail the issue of preparing Chicago for a warmer future or a bigger Cause Map could be built to tackle the problem of global warmer on a larger scale. 

To read more about the Chicago Climate Action Plan, please visit their website.

America’s 104 commercial nuclear reactors produce about 2,000 metric tons of spent nuclear fuel each year.  The United States currently has no long term solution in place to deal with spent nuclear fuel.  The end result of this stalemate is that that there is more than 75,000 tons of spent nuclear fuel at 122 temporary sites in 39 states with nowhere to go. 

Much of the nation’s spent fuel is currently stored in pools near operating nuclear reactors or near sites where reactors once were. Recent events at the Fukushima nuclear plant in Japan have sparked discussion about the potential safety risk of having so much fuel stored near operating reactors creating a situation where one single event can trigger a larger release of radiation.  To make things more complicated, storage pools at US plants are more heavily loaded than the ones at the Fukushima reactors.  Additionally, the pools will reach capacity at some point in the not so distant future and the fuel will have to be moved if the US plans to continue operating nuclear reactors.

How did we get in this situation?  The problem of no long term solution for spent nuclear fuel can be analyzed by building a Cause Map.  A Cause Map is a visual root cause analysis that lays out the causes that contribute to a problem in an intuitive, easy to understand format. Click on “Download PDF” above to view a high level Cause Map of this issue. 

Looking at the Cause Map, it’s apparent one of the causes of this problem is that the plan for the Yucca Mountain Nuclear Waste Repository was canceled without an alternative plan being created.  Yucca Mountain Repository was planned to be a deep geological repository where nuclear waste would be stored indefinitely, shielded and packaged to prevent any release of radiation.  The Yucca Mountain Repository was canceled in 2009 for a number of reasons, some technological and some political.  Environmentalists and residents near the planned site were very vocal about their opposition to the selection of Yucca Mountain site for the nation’s repository.

A Blue Ribbon Commission of experts appointed by President Obama recently presented their recommendations of how to approach this problem.  Their proposal was to develop one or more sites where spent reactor fuel could be stored in above ground steel and concrete structures.  These structures could contain fuel for decades, allowing time for a more permanent solution to be developed.  These structures would not require any cooling beyond simple circulation of air and they could be stored at locations deemed safe, with the lowest risk of earthquakes and other disasters.  Hopefully the recommendations by the commission are the first step to solving this problem and developing a safe long term storage solution to the nation’s nuclear waste.

America’s push for clean energy has certainly been a source of intense debate – the safety of off-shore drilling, the hidden costs of ethanol subsidies, even the aesthetics of wind farms.  New evidence is set to increase the intensity on yet another topic – the debate over hydraulic fracturing. 

Hydraulic fracturing is a process where internal fluid pressure is used to extend cracks, or fractures, into a rock formation.  It can occur in nature, but in man-made operations fractures are made deep in the earth by pumping fluid (mostly water) and a proppant (such as sand) out the bottom of a well.  The proppant prevents the fracture from closing back up after the injection of fluid stops.  Chemicals are sometimes added to the pumping fluid to aid in the process.  These fractures allow the gas or liquid trapped in the rock formation to flow back through the fracture, up the well and out for production. 

More commonly known as “fracking”, the technique is used to release natural gas from shale rock formations.  These formations, especially common on the East Coast and in Canada, have provided thousands of new, well-paying jobs.  Fracking has allowed natural gas companies to access enormous reserves of natural gas, previously thought inaccessible and prohibitively expensive to drill.  In fact fracking has allowed drillers to tap what is potentially the world’s largest known reserve of natural gas in the Marcellus and Utica shale deposits, stretching from New York to Georgia. 

As with any new technology however, there are potential consequences.  Lawmakers and regulators have debated the safety of the largely unregulated fracking industry, but with little definitive evidence either way…until now.  A study by Duke University has concluded that fracking does indeed lead to methane contamination in drinking water.  Methane is the primary component in natural gas and is not lethal to consume.  However, high concentrations are explosive. 

The study determined that fracking causes methane to leak into drinking water.  Water sources within a kilometer were found to have significant levels of methane, more than 17 times higher than wells located further from drilling sites.  Furthermore, it was determined that the source of the methane was the much older methane released from the bedrock, versus newer methane produced naturally in the environment.

 The exact reason for this is unclear, but a Cause Map can lay out the possible areas needing further investigation.  For instance, the frack chemicals might enter the water supply accidentally during the drilling process.  Spills could also contaminate surface water, or chemicals could migrate into the water supply. 

The study indicates that chemical migration is most likely what’s happening.  Surface spills, which have happened, are not a major contributor to the wide-spread methane contamination; so that cause can be left in the Cause Map but won’t be investigated further for our purposes.  Furthermore, the study produced no evidence that the drilling process itself was causing the contamination; so that block can be crossed off the Cause Map.

 That leaves one possibility – migration.  The chemicals (including methane) could migrate in two different ways – through the well casing or through the bedrock.  The study’s authors felt it was unlikely that chemicals were migrating thousands of feet through bedrock, so migration from well casings experiencing high pressure flow  is more probable.  While more evidence is needed, it is possible that the well casings are weakened by the fracking process which pushes sand through the casings at high pressure. 

An EPA study looks to definitively determine fracking’s impact on drinking water, and specifically human health.  However that study is not scheduled to be completed until 2014.  Until then, lawsuits and tighter regulations are likely to dominate headlines.

Gamers worldwide have been twiddling their thumbs for the last two weeks, after a major gaming network was hacked last month.  Sony, well known for its reputation for security, quickly shut down the PlayStation Network after it learned of the attacks, but not before 100+ million customers were exposed to potential identity theft.  Newspapers have been abuzz with similar high-profile database breaches in the last few weeks, but this one seems to linger.  The shut down has now prompted a Congressional inquiry and multiple lawsuits.  What went so wrong? 

A Cause Map can help outline the root causes of the problem.  The first step is to determine how the event impacted company goals.  Because of the magnitude of the breach, there were significant impacts to customer service, property and sales goals.  The impact to Sony’s customer service goals is most obvious; customers were upset that the gaming and music networks were taken offline.  They were also upset that their personal data was stolen and they might face identity fraud.  

However, these impacts changed as more information came to light and the service outage lingered.  Sony has faced significant negative publicity from the ongoing service outage and even multiple lawsuits.  Furthermore customers were upset by the delay in notification, especially considering that the company wasn’t sure if credit card information had been compromised as well. 

As the investigation unfolded new evidence came to light about what happened.  This provided enough information to start building an in-depth Cause Map.  It turns out that network was hacked for three reasons.  Sony was busy fending off Denial of Service attacks, and simultaneously hackers (who may or may not have been affiliated with the DoS attacks) attempted to access the personal information database.  A third condition was required though.  The database had to actually be accessible to hack into, and unfortunately it was. 

Why were hackers able to infiltrate Sony’s database?  At first, there was speculation that they may have entered Sony’s system through its trusted developer network.  It turns out that all the hackers needed to do was target the server software Sony was running.  That software was outdated and did not have firewalls installed.  With the company distracted, it was easy for hackers to breach their minimal defenses.

Most of the data that the hackers targeted was also unencrypted.  Had the data been encrypted, it would have been useless.  This raises major liability questions for the company.  To fend off both the negative criticism and lawsuits, Sony has been proactive about implementing solutions to protect consumers from identity fraud.  U.S. customers will soon be eligible for up to $1M in identity theft insurance.  However other solutions need to be implemented as well to prevent or correct other causes.  Look at the Cause Map; notice how that if you only correct issues related to fraud, there are still impacts without a solution.

Sony obviously needs to correct the server software and encryption flaws which let the hackers access customer’s data in the first place.  Looking to the upper branch of the Cause Map is also important, because the targeted DoS attack and possibly coordinated data breach jointly contributed to the system outage.  More detailed information on this branch will probably never become public, but further investigation might produce effective changes that would prevent a similar event from occurring.

On April 21, 2011, some of Amazon’s Elastic Compute Cloud (EC2) customers experienced issues when a combination of events led to their East region’s Elastic Block Store (EBS) being unable to process read or write operations.  This seriously impacted their customer service.  Massive efforts were undertaken and services, and  most data, was restored within 3 days.  Amazon has released their post-mortem analysis of these events.  Using the information they’ve provided, we can begin a visual root cause analysis, or Cause Map, laying out the event. 

We begin with the affected goal.  Customer service was impacted because of the inability to process read or write operations.  This ability was lost due to a degraded EBS cluster.  (A cluster is a group of nodes, which are responsible for replicating data and processing read and write requests.)  The cluster was degraded by the failure of some nodes, and a high number of nodes searching for replicas. 

At this point, we’ll look into the process to explain what’s going on.  When a user makes a request, a control plane accepts and processes that request to an EBS cluster. The cluster elects a node to be the primary replica of this data.  That node stores the data, and looks for other available nodes to make backup replicas.  If the node-to-node connection is lost, the primary replica searches for another node.  Once it has established connectivity with that node, the new node becomes another replica.  This process is continuous.  

In this case, a higher number of nodes were searching for replicas because they lost connection to the other nodes.  Based on the process discussed above, the nodes then began a search for other nodes.  However, they were unable to find any other nodes because the network was unavailable (so the nodes could not communicate with each other).  The nodes had a long time-out period for searching for other nodes, so their search continued, and more nodes lost communication and began a search, increasing the volume. 

The network communication was lost because data was shifted off the primary network.  This was caused by an error during a network configuration change to upgrade the capacity of the primary network.  The data should have been transferred to a redundant router on the primary network but was instead transferred to the secondary network.  The secondary network did not have sufficient capacity to handle all the data and so was unable to maintain connectivity. 

In addition to a large number of nodes searching for other nodes, the EBS cluster was impacted by node failures.  Some nodes failed because of a race condition designed so that a node would fail when it attempted to process multiple concurrent requests for replicas.  These requests were caused by the situation above.  Additionally, the nodes failing led to more nodes losing their replicas, compounding the difficulty of recovering from this event. 

Service is back to normal, and Amazon has made some changes to prevent this type of issue from reoccurring.   Immediately, the data was shifted back to the primary network and the error which caused the shifting was corrected.  Additional capacity was added to prevent the EBS cluster from being overwhelmed.  The retry logic which resulted in the nodes continuing to search for long periods of time has been modified, and the source of the race condition resulting in the failure of the nodes has been identified and repaired.

View the root cause analysis investigation of this event – including an outline, timeline, Cause Map, solutions and Process Map, by clicking “Download PDF” above.

Around 8:30 pm on April 11, 2011, a large passenger airplane taxiing at John F. Kennedy Airport in New York clipped the wing of a smaller plane.  The larger plane involved in the incident was an Airbus A380 carrying 485 passengers and 25 crew members.  The smaller plane was a Bombardier CRJ and carrying 52 passengers and 4 crew members at the time it was clipped. 

At the time of the accident, the Airbus was taxiing to take off and the CRJ had recently landed and was waiting to park.  The incident was caught on amateur video and it appears that the left wing tip of the Airbus struck the left horizontal stabilizer of the CRJ. No injuries were reported, but both planes sustained some damage. 

After the planes made contact, the fire department responded as a precautionary measure.  Passengers were deplaned from the Airbus so that the planes could be inspected and information could be gathered to support the investigation.

At this time there is limited information available about what caused this incident, but the National Transportation and Safety Board (NTSB) has begun an investigation.  The NTSB has requested fight recorders from both airplanes and also plans to review the air traffic control tapes and the ground movement radar data to determine how this happened.

Even through the investigation is just getting started, it is still possible to create a Cause Map based on what is known.  The first step is to create an Outline of the event by determining the impact to the organization goals.  In this example, the Safety Goal was impacted because there was the potential for injuries, the Customer Service goal was impacted because the passengers were unable to reach their destination, the Production Schedule Goal was impacted because the flight was unable to depart and the Material and Labor goal was impacted because there was damage to both planes. 

From this point, Causes can be added to the cause map by asking “why” question. Missing information can be noted by adding a Cause box with a “?”.  Any additional information can be added later.  To see an initial Cause Map of this incident and the Outline, click on the “Download PDF” above.

On March 28, 2011, a 75 year old woman out digging for scrap metal accidentally cut internet service to nearly all of Armenia.  There were also service interruptions in Azerbaijan and part of Georgia.  Some regions were able to switch to alternative internet suppliers within a few hours, but some areas were without internet service for 12 hours.

How did this happen?  How could an elderly woman and a shovel cause such chaos without even trying?

A root cause analysis can be performed and a Cause Map built to show what contributed to this incident.  Building a Cause Map begins with determining the impacts to the organizational goals.  Then “why” questions are asked and causes are added to the map.

In this example, the Customer Service Goal is impacted because there was significant internet service interruption and the Production Schedule Goal was also impacted because of loss of worker productivity.  The Material Labor Goal also needs to be considered because of the cost of repairs.

Now causes are added to the Cause Map by asking “why” questions.  Internet service was disrupted because a fiber optic cable was damaged by a shovel.  In addition, this one cable provided 90 percent of Armenia’s internet so damaging it created a huge interruption in internet service. 

Why would a 74 year old woman be out digging for cables?  The woman was looking for copper cable and accidentally hit the fiber optic cable.  This happened because both types of cables are usually buried inside PCV conduit and can look similar.  The reason she was looking for copper cable is because there is a market for scrap metal.  Metal scavenging is a common practice in this region because there are many abandoned copper cables left in the ground.  She was also able to hit the fiber optic cable because it was closer to the surface than intended, likely exposed by mudslides or heavy rains.

The woman, who had been dubbed the spade-hacker by local media, has been released from police custody.  She is still waiting to hear if she faces any punishment, but police statements implied that the prosecutor won’t push for the maximum of three years in prison due to her age.

To see the Cause Map of this issue, click on the “Download the PDF” button above.

As new information comes to light, processes need to be reevaluated.  A hole in the fuselage of a 15-year-old Boeing 737-300 led to the emergency descent of Southwest Airlines Flight 812.  737′s have been grounded as federal investigators determine why the hole appeared.  At the moment, consensus is that a lap joint supporting the top of the fuselage cracked. 

While the investigation is still in the early stages, it appears that stress fatigue caused a lap joint to fail.  Stress fatigue is a well known phenomenon, caused in aircraft by the constant pressurization and depressurization occurring during takeoff and landing.  Mechanical engineers designing the aircraft would have been well aware of this phenomenon.  The S-N curve, which plots a metal’s expected lifespan vs. stress, has been used for well over a century.  

Just as a car needs preventative maintenance, planes are inspected regularly for parts that are ready to fail.  However, the crack in lap joint wasn’t detected during routine maintenance.  In fact, that joint wasn’t even checked.  It wasn’t an oversight however.  Often the design engineers also set the maintenance schedule, because they hold the expertise needed to determine a reasonable procedure.  The engineers didn’t expect the part to fail for at least 20,000 more flight hours.  At the moment, it’s unclear why that is.

In response to the incident, the FAA has grounded all similar aircraft and ordered inspections of flights nearing 30,000 flight hours.   Cracks have been found in 5 aircraft of 80 grounded aircraft so far.  However a looming concern is how to deal with 737’s not based in the United States, and therefore outside the FAA’s jurisdiction.

At least three times over the past decade, air traffic controller fatigue has been investigated by the National Transportation Safety Board (NTSB) in near-miss airline accidents.  Five years ago, controller fatigue was a significant factor in a Lexington, KY crash killing 49, the last fatal crash related to this problem.  Again last week, controller fatigue was in the news when two early-morning aircraft had uncontrolled landings at Reagan National Airport near Washington D.C.  The controller, who had 20 years of experience with most of them at Reagan, was clearly well experienced.  In fact, the controller was also a supervisor.  But no level of experience can overcome the effects of fatigue.  The relieved controller stated that he had worked the 10 p.m. to 6 a.m. shift four nights in a row. 

Faced with harsh criticism over the latest incident, the FAA reacted by mandating a second controller at Reagan National Airport and reviewing traffic management policies at all single-person towers.  Regional radar controllers are now required to check in with single-person towers during night shifts to ensure controllers are prepared to handle incoming traffic. 

Controller fatigue is a well known problem, and multiple solutions have been suggested over the past two decades.  It has been a part of the NTSB’s Most Wanted list since 1990.  In 2007 following the Lexington crash, the NTSB urged the Federal Aviation Administration (FAA) to overhaul their controller schedules, claiming that the stressful work and hectic pace were putting passengers and crews at risk.  The FAA responded, and is currently working with the National Air Traffic Controllers Association (NATCA) to develop “a science-based controller fatigue mitigation plan”.

In addition, from 2007 to 2011, more than 5,500 new air traffic controllers were hired.  However, many of these simply replaced air traffic controllers who were retiring, resulting in no net gain in the pool of available labor.  Air traffic controllers have a mandated retirement age of 56, with exceptions available up to age 61.  Additionally, on-the-job training is extensive, requiring two to four years just to receive initial certification.  Adding staffing therefore is more difficult than initially meets the eye.

 Faced with an expected increase in air traffic and an aging infrastructure, the FAA has aggressively pursued a long-term modernization called NextGen.  With the proposed modernization and staffing, the 2011 FAA budget request is now $1.14B, a $275M or 31% increase from 2010.  While material and personnel changes are often necessary, sometimes simpler solutions are equally effective or quicker to implement.

 The associated Cause Map reflects the multiple solutions suggested, and even implemented, to combat the problem of controller fatigue.  As discussed, the FAA, NTSB and NATCA have pursued multiple paths to overcome the issue of controller fatigue.  However, as the Cause Map shows, there are multiple contributing factors in this case.  Controller fatigue isn’t the only reason those planes had an uncontrolled landing, and controller fatigue wasn’t caused by just four night shifts in a row.  Because there are multiple reasons why this happened, it also means there are multiple opportunities to correct future problems.  The key isn’t eliminating all of the causes, but rather eliminating the right one.

There are many complex events occurring with some of Japan’s nuclear power plants as a result of the earthquake and tsunami on March 11, 2011.  Although the issues are still very much ongoing, it is possible to begin a root cause analysis of the events and issues.  In order to clearly show one issue, our analysis within this blog is limited to the issues affecting Fukushima Daiichi Unit 3.  This is not to minimize the issues occurring at the other plants and units, but rather to clearly demonstrate the cause-and-effect within one small piece of the overall picture.

The issues surrounding Unit 3 are extremely complex.  In events such as these, where many events contribute to the issues, it can be helpful to make a timeline of events.  A timeline of the events so far can be seen by clicking “Download PDF” above.  A timeline can not only help to clarify the order of contributing events, it can also help create the Cause Map, or visual root cause analysis.  To show how the events on the timeline fit into the Cause Map, some of the entries are denoted with numbers, which are matched to the same events on the Cause Map.  Notice that in general, because Cause Maps build from right to left with time, earlier entries are found to the right of newer events.  For example, the earthquake was the cause of the tsunami, so the earthquake is to the right of the tsunami on the map.  Many of the timeline events are causes, but some are also solutions.  For example, the venting of the reactor is a solution to the high pressure.  (It also becomes a cause on the map.)

A similar analysis could be put together for all of the units affected by the earthquake, tsunami and resulting events.  Parts of this cause map could be reused as many of the issues affecting the other plants and units are     similar to the analysis shown here. It would also be possible to build a larger Cause Map including all impacts from the earthquake.

The impact to goals needs to be determined prior to building a Cause Map. As a direct result of the events at Unit 3, 7 workers were injured.  This is an impact to the worker safety goal.  There is the potential for health effects to the population, which is an impact to the public safety goal.  The environmental goal was impacted due to the release of radioactivity into the environment.  The customer service goal was impacted due to evacuations and rolling blackouts, caused by the loss of electrical production capacity, which is an impact to the production goal.  The loss of capacity was caused by catastrophic damage to the plant, which is an impact to the property goal.  Additionally, the massive effort to cool the reactor is an impact to the labor goal.

The worker safety and property goals were impacted because of a hydrogen explosion, which was caused by a buildup of pressure in the plant, caused by increasing reactor temperature.  Heat continues to be generated by a nuclear reactor, even after it is shutdown, as a natural part of the operating process.  In this case, the normal cooling supply was lost when external power lines were knocked down by the tsunami (which was caused by the earthquake).  The tsunami also apparently damaged the diesel generators which provided the emergency cooling system.  The backup to the emergency cooling supply stopped automatically and was unable to be restarted, for reasons that are as yet unknown.      

The outline, timeline and cause map shown on the PDF are extremely simplified.  Part of this simplification is due to the fact that as the event is still ongoing and not all information is known, or has been released. Once more information becomes available, it can be added to the analysis, or the analysis can be revised. 

If you’d like to learn more about how this timeline was created and how timelines in general can add to the   understanding of incidents such as those occurring in Japan, please join us for a FREE Webinar.

On July 7, 2010, a barge being propelled by a tug boat collided with a tour boat that had dropped anchor in the Delaware River.  As a result of the collision, two passengers on the tour boat were killed and twenty-six were injured.  The tour boat sank in 55 feet of water. 

Detail regarding the incident has just been released in an updated NTSB report.  We can use the information about this report to begin a Cause Map, or visual root cause analysis.  The information in the report can also point us in the direction of important questions that remain to be answered to determine exactly what happened and, most importantly, how incidents like these can be prevented in the future. 

In this case, a tour boat had dropped anchor to deal with mechanical problems.  According to the tour boat crew’s testimony and radio recordings, the tour boat crew attempted to get in touch with the tug boat by yelling and making radio calls.  Neither were answered or apparently noticed.  The barge that was being propelled by the tug boat crashed into the tour boat, resulting in deaths, injuries and loss of the tour boat.  

The lookout on the tug boat was inadequate (had it been adequate, the tug boat would have noticed the tour boat in time to avoid the collision).  The report has determined that the tug boat master was off-duty and below-deck at the time of the collision.  According to cell phone records, the mate who was on lookout duty was on a phone call at the time of the collision and had made several phone calls during his duty. The inadequate lookout combined with the inability of the tour boat to make contact with the tug boat resulted in the collision. 

There are two obvious areas where more detail is needed in the Cause Map to determine what was going on that led to the issues on the tug boat.  Specifically, why was the lookout on the cell phone and why wasn’t the tour boat able to contact the tug boat through the radio?  Because of the strict requirements for lookouts on marine duty, there is also an ongoing criminal investigation into the lookout’s actions.  When the final NTSB report is issued, and the criminal case is closed, these questions should be answered.  More detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

The Golden Gate City is well known for its ground-breaking, environmentally-friendly initiatives.  In 2007 San Francisco outlawed the use of plastic bags at major grocery stores.  The city also mandated compulsory recycling and composting programs in 2009.  Both ordinances were the first laws of their kind in the nation, and criticized by some for being overly aggressive.  Likewise San Francisco’s latest initiative, to reduce city water usage by encouraging the use of low-flow toilets, has faced harsh criticism.

Recently San Francisco began offering substantial rebates to homeowners and businesses to install high efficiency toilets (HETs).  These types of toilet use 1.28 gallons or less per flush, down from the 1.6 gpf versions required today by federal law and even older 3.4 gpf toilets from decades ago.  That means that an average home user will save between 3,800 to 5,000 gallons of water per year per person.  In dollars, that’s a savings of $90 annually for a family of four.  This can quickly justify the cost of a new commode, since a toilet is expected to last 20 years.

Aside from cost savings, there are obvious environmental benefits to reduced water use.  The city initially undertook the HET rebate initiative to decrease the amount of water used overall by the city and the amount of wastewater requiring treatment.  They were successful, and water usage decreased.  In fact, the city’s Public Utilities Commission stated that San Francisco residents reduced their water consumption by 20 million gallons of water last year.  San Francisco last year used approximately 215 million gallons per day.  This also met other goals the city had, such as reducing costs to consumers.  Unintentionally though, the HET rebate initiative impacted a different goal – Customer Service. 

As shown on the associated Cause Map, reduced water flow had a series of other effects.  While water consumption – and presumably waste water disposal – shrank significantly, waste production has remained constant.  Despite $100M in sewage systems upgrades over the past five years, current water flow rates are not high enough to keep things moving through the system.  As a result sewage sludge builds up in sewer lines.  As bacteria eat away at the organic matter in the sludge, hydrogen sulfide is released.  Hydrogen sulfide is known for its characteristic “rotten egg” smell.

This creates an unfortunate situation.  No one wants to walk through smelly streets.  Further, slow sewage means a build-up of potential harmful bacteria.  However, everyone agrees San Francisco should strive to conserve water.  Water is a scarce and increasingly expensive resource in California.  What’s the next step in solving the stinking sewer problem?

San Francisco is not the first city to deal with this issue.  There is substantial debate over the city’s current plan to purchase $14M in bleach to clean up the smell.   Many parties are concerned about potential environmental impacts and potential contamination to drinking water.  Other solutions have been proposed by environmental activists, but may have financial ramifications.

Cause Maps can help all parties come to agreement because they focus problem solvers on the goals, not the details of the problem.  In this case, all parties are trying to protect the environment and reduce costs to city residents.  Based on those goals and the Cause Map, potential solutions have been developed and placed with their corresponding causes.  The next step is to proactively consider how these new actions might affect the stakeholders’ goals.  Perhaps other goals could be impacted, such as the safety of drinking water and potential contamination of San Francisco Bay.  Financial goals will surely be impacted to varying degrees with each solution.  Revising the Cause Map can help identify the pros and cons of each approach and narrow down which solution best satisfies all parties.

On December 25, 2007, a tiger escaped her enclosure at the San Francisco Zoo and attacked three people.  One 17 year old boy was killed and the other two were injured. The enclosure was built in the 1940s and had safely contained tigers for more than 60 years without incident.

So how did this happen?  How did the tiger escape?

A Cause Map can be built using this example to help determine how this incident was able to occur. To begin a Cause Map, the impacts to the organizational goals are first determined and then “why” questions are asked to add causes to the map.  In this case, there was obviously an impact to the safety goal because one zoo patron was killed and two were injured.  The customer service goal was also impacted because the zoo was closed until January 3, 2008 following the incident.  Why was a zoo patron killed?  He was killed because he was mauled by a tiger.  Why was he mauled?  Because the tiger escaped her enclosure and she went after the victims. 

Let’s focus on the question of how the tiger escaped her enclosure first.  An investigation was conducted by the United States Department of Agriculture’s Animal and Plant Health Inspection Service, the government body who is charged with overseeing the nation’s zoos.  Based on claw marks and other evidence at the scene, they determined that the tiger jumped from the bottom of a dry moat and was able to pull herself over the fence surrounding her enclosure.  The investigation also determined the fence was lower than typically used around tiger enclosures.  The Association of Zoos & Aquariums recommends that walls around a tiger exhibit be at least 16.4 feet and the fence around the San Francisco Zoo was only 12.5 feet at the time.

The second question of why the tiger went after the boys is not as easy to answer.  A few experts have stated that the tiger didn’t behave in a typical way.  There has been significant speculation in the media that the victims taunted the tiger or provoked her in some way, but nothing has ever officially been determined.

This focus on the behavior of the victims is a good example of some of the issues that can come up during an investigation.  It can be tempting to focus on assigning blame when investigating an incident.  But the real question is “What should we do to prevent this from happening again?”.  Whether or not the boys provoked the tiger, she should never have been able to escape her enclosure. 

After the incident, the zoo extensively remodeled the tiger enclosure, adding a much higher fence and with hotwire at the top to prevent any similar incidents from occurring.

All business strive to make their processes as efficient as possible and maximize productivity.  Minimizing excess inventory only seems sensible, as does placing process equipment in a logical manner to minimize transit time between machines.  However, when productivity consistently takes precedence over safety, seemingly insignificant decisions can snowball when it matters most.

Using the Phillips 66 explosion of 1989 as an example, it is easy to see how numerous efficiency-related decisions snowballed into a catastrophe.  Examining different branches of the Cause Map highlights areas where those shortcuts played a role.  Some branches focus on how the plant was laid out, how operations were run and how the firefighting system was designed.  Arguably, all of these areas were maximized for production efficiency, but ended up being contributing factors in a terrible explosion and hampered subsequent emergency efforts.

For instance, the Cause Map shows that the high number of fatalities was caused not just by the initial explosion.  The OSHA investigation following the explosion highlighted contributing factors regarding the building layout.  The plant was cited for having process equipment located too closely together, in violation of generally accepted engineering practices.  While this no doubt maximized plant capacity, it made escape from the plant difficult and did not allow adequate time for emergency shutdown procedures to complete.  Additionally high occupancy structures, such as the control room and administrative building were located unnecessarily close to the reactors and storage vessels.  Luckily over 100 personnel were able to escape via alternate routes.  But luck is certainly not a reliable emergency plan; the plant should have been designed with safety in mind too.

Nearby ignition sources also contributed to the speed of the initial explosion, estimated to be within 90 to 120 seconds of the valve opening.  OSHA cited Phillips for not using due diligence in ensuring that potential sources of ignition were kept a safe distance from flammable materials or, alternatively, using testing procedures to ensure it was safe to bring such equipment into work zones.  The original spark source will never be known, but the investigation identified multiple possibilities.  These included a crane, forklift, catalyst activator, welding and cutting-torch equipment, vehicles and ordinary electrical gear.   While undoubtedly such a large cloud of volatile gas would have eventually found a spark, a proactive approach might have provided precious seconds for workers to escape.  All who died in the explosion were within 250 feet of the maintenance site.

Another factor contributing to the extensive plant damage was the inadequate water supply for fire fighting, as detailed in the Cause Map.  When the plant was designed, the water system used in the HDPE process was the same one that was to be used in an emergency.  There is no doubt a single water system was selected to keep costs down.  Other shortcuts include placing regular-service fire system pump components above ground.  Of course, the explosion sheared electrical cords and pipes controlling the system, rending it unusable.  Not only was the design of the fire system flawed, it wasn’t even adequately maintained.  In the backup diesel pump system, only one of three pumps was operational; one was out of fuel and the other simply didn’t work.  Because of these major flaws, emergency crews had to use hoses to pump water from remote sources.  The fire was not brought under control until 10 hours after the initial explosion.  As the Cause Map indicates, there may not have been such extensive damage had the water supply system been adequate.

There is a fine line between running processes at the utmost efficiency and taking short-cuts that can lead to dangerous situations.  Clearly, this was an instance where that line was crossed.

The town of Allentown, Pennsylvania suffered severe physical and emotional damage on February 9, 2011, when 5 people were killed and 8 homes were completely destroyed.  The deaths and destruction were believed to be caused by a natural gas explosion, fueled by a 12″ gas main break.  In addition to the impacts to the safety and property goals, the natural gas leak, extended fire, and time/labor by 53 responders also impacted goals. 

We can analyze the causes of these impacts to the goals with a visual root cause analysis.  Beginning with the impacts to the goals, we ask why questions to determine the causes that contributed to the incidents.  In this case, there was a delay in putting out the fire because the fire had a heat source from the explosion, a constant oxygen source (the environment) and a steady supply of fuel, as the natural gas continued to leak.  There was no shut-off valve to quickly stop the flow of gas.  It took the utility company 5 hours to finally turn off the gas.  It took 12 more  hours before the fire was completely put out. 

The fuel for the explosion and the fire is believed (according to the utility company) to have come from a break discovered in the 12″ gas main.  A 4′ section of pipe, removed on February 14th, is being sent for a forensic analysis to aid in determining what may have contributed to the crack.  It’s possible there was prior damage – such as that from weather or prior excavations.  Most of the pipe in the area was installed in the 1950s, although some is believed to be from the 1920s.  Budget shortfalls have delayed replacing, or even inspecting the lines in the area, and officials have warned that continuing financial issues may continue to delay inspections and improvements,  causing concern with many residents, who suffered a similar natural gas pipeline explosion in 1994.

 Because implementation of potential solutions to improve the state of the utility lines in the area may be limited by available funding, it’s unclear what will be done to attempt to reduce the risk of a similar incident in the future.   However, the unacceptability of resident casualties should stir some action so that this doesn’t happen again.

Many of the industrial safety standards that we take for granted are the direct result of catastrophes of past decades.  Today there are strict regulations on asbestos handling, exposure limits for carcinogens, acceptable noise levels, the required use of personal protective equipment, and a slew of other safety issues.  The organization charged with enforcing those standards is the Occupational Health and Safety Administration – OSHA for short. 

OSHA was founded in 1970, in an effort to promote and enforce workplace safety, and their stated mission is to “assure safe and healthful working conditions for working men and women”.  However, there was considerable controversy during its early years as it spottily began enforcing, what was perceived as, cumbersome and expensive regulations.  Notable events in the 1980s, such as the Bhopal and West Virginia Union Carbide industrial accidents, raised OSHA’s awareness that fundamental changes were needed to develop more effective safety management systems.

This awareness led to the rise of what is now known as Process Safety Management (PSM).  This discipline covers how industries safely manage highly hazardous chemicals.  OSHA’s PSM standard lays forth multiple requirements such as employee and contractor training, use of hot work permits, and emergency planning.  Unfortunately PSM was still a work-in-progress during the fall of 1989.

On October 23, 1989, the Phillips 66 Petroleum Chemical Plant near Pasadena, Texas, then producing approximately 1.5 billion of high-density polyethylene (HDPE) plastic each year, suffered a massive series of explosions.  23 died and hundreds were injured in an explosion that measured at least 3.5 on the Richter scale and destroyed much of the plant.  Many of the deficiencies identified at the Phillips 66 plant were in violation of OSHA’s PSM directives; directives which had been announced, but had not yet been formally enacted.

Looking at the Phillips 66 Explosion Cause Map, one can see how a series of procedural errors occurred that fateful day.  Contract workers were busy performing a routine maintenance task of clearing out a blockage in a collection tank for the plastic pellets produced by the reactor.  The collection tank was removed, and work commenced that morning.  However, at some point just after lunch, the valve to the reactor system was opened, releasing an enormous gas cloud which ignited less than two minutes later.

The subsequent OSHA investigation highlighted numerous errors.  First, the air hoses used to activate the valve pneumatically were left near the maintenance site.  When the air hoses were connected backwards, this automatically opened the valve, releasing a huge volatile gas cloud into the atmosphere.  It is unknown why the air hoses were reconnected at all.  Second, a lockout device had been installed by Phillips personnel the previous evening, but was removed at some point prior to the accident.  A lockout device physically prevents someone from opening a valve.  Finally, in accordance with local plant policy but not Phillips policy, no blind flange insert was used as a backup.  The insert would have stopped the flow of gas into the atmosphere if the valve had been opened.  Had any of those three procedures been executed properly, there would not have been an explosion that day.  According to the investigation, contract workers had not been adequately trained in the procedures they were charged with performing.

Additionally, there were significant design flaws in the reactor/collector system.  The valve system used had no mechanical redundancies; the single Demco ball valve was the sole cut-off point between the highly-pressurized reactor system and the atmosphere.  Additionally, there was a significant design flaw with the air hoses, as alluded to earlier.  Not only were the air hoses connected at the wrong time, but there was no physical barrier to prevent them from being connected the wrong way.  This is the same reason North American electrical plugs are mechanically keyed and can only be plugged in one way.  It can be bad news if connected incorrectly!  Connecting the air hoses backward meant the valve went full open, instead of closed.  Both of these design flaws contributed to the gas release, and again, this incident would not have occurred if either flaw was absent.

In hindsight, one can see how multiple problems led to such devastating results.  To easily understand the underlying reasons behind the Phillips 66 Explosion of 1989, a high-level Cause Map provides a quick overview of the event.  Breaking a section of the Cause Map down further can provide significant insight into the multiple reasons the event occurred.  The associated PDF for this case shows how different levels of a Cause Map can provide just the right amount of detail for understanding a complex problem such as this one.

The Phillips 66 explosion was a tragedy that could have been avoided.  The industrial safety standards that OSHA is charged with enforcing aim to prevent future tragedies like this one.  While a gradual safety-oriented transformation has come with some pain and a price tag, few will argue that such standards are unnecessary.  Industrial workers deserve to work in an environment where risk to their health has been reduced to the most practical level.

Few ever contemplate the complex system of utilities surrounding us.  The beauty of our modern standard of living is that usually there is little reason to think about those things.  Those rare cases where power isn’t available at the flip of a switch, or fresh water at the turn of a faucet usually make the local news.

Sadly, the community of San Bruno was faced with much more than simple inconvenience.  On September 9, 2010, an explosion ripped through the suburban community, ultimately killing 8 and destroying or damaging 100 homes.  The explosion was caused by a ruptured natural gas pipeline, and it appears that a slight increase in pipe pressure led to the final failure.  That change in pressure resulted from a glitch in maintenance procedures at a pipeline  terminal.  While ultimately that glitch may have been the “straw that broke the camel’s back”, it is clear from the Cause Map analysis that the straw pile was already fairly high. 

Based on National Transportation Safety Board reports, both poor pipe construction and inadequate record-keeping played a major role in the failure.  The pipes, at or near their life expectancy, were already considered too thin by the 1950s’ standards when they were originally installed.  Furthermore improperly done welding made the pipes susceptible to corrosion.  Compounding these issues was the fact that PG&E, the utilities company responsible the pipeline, wasn’t even aware that the San Bruno pipeline had such extensive welding.  This matters because gas pressures are calculated based on a number of inputs, including the construction of the pipeline.  Even that slight increase in pressure proved to be more than the aging pipe could handle.

Natural gas pipelines are fairly extensive in the United States, and with suburban sprawl many communities live close to these pipelines.  In fact, many states have already taken steps to prevent similar events from occurring in their community.  Multiple utilities companies have been mandated to install newer pipelines, as in Texas and Washington.  Additionally, the federal government requires that newly constructed pipelines must be inspected by “smart pigs” – robots able to maintain and inspect pipeline systems.  However, modernizing this aging infrastructure will be expensive for many communities.  

Perhaps there are easy, inexpensive interim solutions available.  The Cause Map analysis identifies all causes leading to the explosion, and then provides a systematic method for developing solutions.  Hopefully some of the solutions generated will prevent future disasters, like the one in San Bruno.

Most students go to college hoping it will further their education and allow them better career opportunities upon graduation.  But is the investment of time and money required to get a college education worth it?

The cost of college has been rapidly increasing over the last several years.  At the same time, many company executives have been noting that today’s students do not graduate college with the critical thinking skills necessary to succeed.  A new book, “Academically Adrift: Limited Learning on College Campuses,” by sociologists Richard Arum of New York University and Josipa Roksa of the University of Virginia publishes findings of a study that says that students aren’t improving much in the areas of “critical thinking, complex reasoning and writing” during their four years in college.

The study based its results on assessment scores taken by 2,300 students as they entered college, after two years, and after four years.  After two years, 45% of students showed insignificant improvement and after four years, 36% showed insignificant improvement.  The study also found that very little reading and writing is required in many college courses.

The findings indicate that students aren’t being adequately prepared for their future careers.  How do we solve this problem?  Similar to engineering problems, a root cause analysis could be performed to help understand and hopefully solve this problem.  The more clearly a problem is understood, the easier it is to develop and implement solutions.  There are some potential solutions that have been suggested already, but only time will tell if they are successful.

 Many institutions of higher learning are working to combat the issue.  More than 70 college and university presidents have pledged to take steps to improve instruction and student learning, and make those results public.  Hopefully the colleges and universities that have pledged to use evidence-based solutions to improve learning will pave the way for all colleges and universities increasing the critical thinking and writing skills of all college graduates.

There are also a number of things that students can do to improve their own learning.  The study found that students who study alone (as opposed to in study groups) are more likely to post gains over college.  Additionally, students who choose to read and write more, and attend more selective schools that focus on teaching rather than research tend to improve their critical thinking and writing skills over their years at college.

Everyone should agree that a large percent of students graduating from college showing little or no improvement in critical reasoning and writing skills is not a desirable outcome – i.e. a problem.  There are many ways to improve the situation.  Some of these solutions must be implemented by the universities themselves, but students can take many actions themselves to increase their learning over their college years. 

Click here to read more about this topic.

Around 3 pm on April 5, 2010 in Montcoal, West Virginia, a huge explosion rocked the Upper Big Branch South mine killing 29 (Click here to read previous blog on the topic).  The toxic gas concentration in the mine remained so high after the accident that Mine Safety and Health Administration investigations were not able to enter the mine for more than two months after the accident.  The final report is still two to three months away, but the MSHA has developed a working theory on what caused the mine explosion.

According to a recent NPR article, investigators believe they have found the source of the spark that started the chain of events that lead to the massive mine explosion.  A longwall mining machine was in operation inside the mine, creating sparks as it ate through both coal and sandstone.  Sparking may have been worse than usual because investigators found that the carbide tipped teeth on the machine were worn down so that bare metal was contacting the stone and coal. 

Sparks are expected during these types of operations so a water sprayer system is typically used to prevent explosions from occurring, but investigations found the water system in Upper Big Branch was not functioning properly.  Additionally, a properly functioning water spray system would help control the amount of coal dust in the air.  Coal dust is an accelerant, which means it will contribute to an explosion if ignited.

Another cause of this accident is the level of methane gas in the environment.  The Upper Big Branch South mine is a particularly gassy mine that naturally emitted high levels of methane gas.  There are still some open questions about the role ventilation may have played in the accident.  

Small ignitions of methane gas are not uncommon in coal mines, but large explosions are rare.  According to data collected by Mine Safety and Health News, about 600 ignitions have occurred in the past 10 years without any major mine explosions occurring.

Coal mining involves managing a tricky combination of coal dust, methane and sparks.  Usually, no one gets hurt, but in this case the mixture resulted in a massive explosion that traveled more than two miles inside the mine and claimed the lives of 29.  Performing a thorough root cause analysis can help investigators understand what was different in this case and hopefully help the lessons learned be applied to other mines. 

As more information comes available, the Cause Map can be expanded to include all relevant details.  Click “Download PDF” above to view the intermediate level Cause Map for this example.

Nearly every state in the US has a law requiring seat belts to be worn in cars. The lone state that doesn’t require adults to wear seat belts, New Hampshire, still has a law requiring children under 18 to wear seat belts.

Currently, only 6 states require seat belt in school buses.  The federal government does not require seat belts to be in installed in buses weighing over 10,000 lbs.  The regular school buses that make up 80 percent of the buses in this country exceed this weight limit and most do not have seat belts.

So if seat belts are required by law in cars, why don’t all school buses have seat belts?

Like most engineering problems, this isn’t as simple a question as it first appears.  The main reason that seat belts aren’t required on all buses is that buses are fundamentally different from cars.

School buses are heavier and taller than cars.  During an accident, a passenger on a bus experiences less severe crash forces than an occupant of a passenger car.  The interior of a modern school bus is designed to protect passengers passively through something called compartmentalization.  The seats are strong, closely-spaced, high backed, and covered in 4 inch thick foam to absorb energy.  The passenger is protected by the cushioned compartment created by the seats.

Buses are considered to be the safest form of ground transportation.  According to the National Highway Traffic Safety Administration, buses are approximately seven times safer than passenger cars or light trucks.

But would seat belts make them even safer?

This is subject to debate.  There are groups pushing for the federal government to require seat belts on all buses.  Others believe that the potential for misuse and incorrectly worn seat belts would actually result in a higher risk to safety if seat belts were installed.  There are also practical considerations like finding funding in cash strapped budgets to install seat belts and to buy the extra buses that would be necessary since fewer students can be accommodated on a bus with seat belts than one without.

There are few topics touchier than the safety of children and no clear cut answers to the question of what constitute a design that is safe enough.  It could be useful when dealing with a problem like this where emotions might run high to document all information in a Cause Map.  A Cause Map is a visual root cause analysis that incorporates the information associated with an issue in an easy to read format.  All pertinent evidence and facts associated with the topic can be recorded.  Having the same facts available to all invested parties can help keep the discussion production and uncover the best solutions.

To learn more about school bus safety, please visit the National Transportation Safety Board website and National Highway Traffic Safety Administration website.

At about 5 am in the morning on Sunday, December 12, 2010, the roof of the Metrodome collapsed under the weight of snow accumulated during the heaviest snow storm in almost two decades.  According to the National Weather Service, Minneapolis received a whopping 17.1 inches of snow between Friday and Saturday night. 

The Metrodome is home to the Minnesota Vikings and its collapse set off a multicity scramble as the NFL worked to reschedule the Monday night game between the Vikings and the Giants that was planned to take place in the Metrodome on December 13.  After considering all the options, the game was moved to Detroit.  (Ironically, this was the first Monday night game played in Detroit in a decade because of the Detroit Lions’ abysmal record.)

Despite some early optimism, the latest update is that repairs will not be completed until March. The damage to the Metrodome moved the last two games of the Vikings’ season and will impact the schedule of about 300 college baseball games along with many other events planned in the venue.  In addition to the massive schedule impact, the cost associated with the repairs will be significant.

Why did this happen? 

A Cause Map can be started using the information that is known.  To build a Cause Map, begin with the impacted goals and add Causes by asking why questions.  In this case, the impacted goals considered are the Production-Schedule goal and the Safety goal.  Fortunately, there were no injuries during the collapse, but the impact to this goal is included because of the potential for injuries if the Metrodome collapsed while occupied.  Click on the “Download PDF” button above to see the initial Cause Map built for this example. 

The Metrodome design includes an inflatable dome to protect the venue from the harsh Minnesota winters.  The massive amount of snow accumulation on the dome after the severe storm exceeded the capacity of the dome to stay inflated.  The dome is made of two layers of materials (the outside layer is Teflon coated fiberglass and the inner layer is made from a proprietary acoustical fabric) and air is constantly pumped into the space between the layers to keep it inflated.  The massive weight of the snow tore the roof in several places and it collapsed. 

The high winds that accompanied the snow fall were also one of the causes contributing to this accident.  When there are heavy snow falls, workers typically climb on the roof of the Metrodome and use steam and high powered hot water hoses to melt snow and limit accumulation.  Workers were unable to access the roof due to safety concerns because of the strong winds.  Additionally, the other measures used to prevent accumulation were inadequate.  These measures include pumping hot air into the dome and heating the stadium to about 80 degrees to help melt snow.

To view a video of the Metrodome collapsing from inside dome click here.

In October, the U.S. government discovered that some of the newly redesigned $100 bills were coming off the printing press with blank spots caused by creases in the paper at both sites of the Bureau of Engraving and Printing, Washington, D.C. and Fort Worth, Texas.  The government has recently announced that this will cause a delay in the introduction of these bills, planned for the spring of 2011. 

 Additionally, the bills that have blank spots will have to be  shredded and reprinted.  Because of complex new security features aimed at deterring counterfeiters (such as a 3-D security strip woven into the paper), the bills cost $0.12 to print.  Hundreds of millions of bills have been printed, with a possible cost of this issue in the millions of dollars.

 Although issues with currency are expensive, they’re also rare. The last time that a printing issue caused a delay in the introduction of a new bill was 1987.  It’s unclear at this point when the bills will finally be released.

 It’s also unclear what happened to cause the paper to crease, creating blank spots from printing.  The additional complexity of this bill with the additional security features is being looked at, as are issues with the paper and the printing machines.  However, because similar errors occurred at both printing sites, it’s unlikely that there is a specific issue with just one site’s machines.  Although the investigation into what caused the blank spots is ongoing, we can begin a root cause analysis with what is currently known.  Once more information is discovered, the Cause Map can be updated.  

 Because of the high potential financial losses from this issue, the eventual investigation will likely go into great  detail and to determine fully what happened will take some time.  The Cause Map and outline for the information known now can be viewed by clicking “Download PDF” above.

NASA’s plan to launch Discovery on its final mission continues to face setbacks.  As discussed in last week’s blog, the launch of Discovery was delayed past the originally planned launch window that closed on November 5 as the result of four separate issues.  

 One of these issues was a crack in a stringer, one of the metal supports on the external fuel tank.  NASA engineers haven identified additional stringer cracks that must also be repaired prior to launch.  These cracks are typically fixed by cutting out the cracked metal and bolting in new pieces of aluminum called doublers because they are twice as thick as the original stringers. The foam insulation that covers the stringers must then be reapplied.  The foam needs four days to cure, which makes it difficult to perform repairs quickly. 

Adding to the complexity of these repairs is the fact that this is the first time they have been attempted on the launch pad. Similar repairs have been made many times, but they were performed in the factory where the fuel tanks were built.

Yesterday, NASA stated that the earliest launch date would be the morning of December 3.  If Discovery isn’t ready by December 5, the launch window will close and the next opportunity to launch will be late February.

 NASA has stated that as long as Discovery is launched during the early December window the overall schedule for the final shuttle missions shouldn’t be affected.  Currently, the Endeavor is scheduled to launch during the February window and it will have to be delayed if the launch of Discovery slips until February.

 In a situation like this, NASA needs to focus on the technical issues involved in the repairs, but they also need to develop a work schedule that incorporates all the possible contingencies.  Just scheduling everything is no easy feat.  In additional to the schedule of the remaining shuttle flights, the timing of Discovery’s launch will affect the schedule of work at the International Space Station because Discovery’s mission includes delivering and installing a new module and delivering critical spare components.  

When dealing with a complex process, it can help to build a Process Map to lay out all possible scenarios and ensure that resources are allocated in the most efficient way.  In the same way that a Cause Map can help the root cause analysis process run more smoothly and effectively, a Process Map that clearly lays out how a process should happen can help provide direction, especially during a work process with complicated choices and many possible contingencies.

Launching a space shuttle is a complicated process (as we discussed in last week’s blog).  Not only is the launching process complex, finding an acceptable date for launch is also complex.  This was demonstrated this week as the shuttle launch was delayed four times, for four separate issues and now will not be able to happen until the end of the month, at the earliest. 

There are discrete windows during which a launch  to the International Space Station (which is the destination of this mission) can occur.  At some times, the solar angles at the International Space Station would result in the shuttle overheating while it was docked at the Space Station.  The launch windows are open only when the angles are such that the overheating will not occur.  

The previous launch window was open until November 5th.  The launch was delayed November 1st for helium and nitrogen leaks, November 2nd for a circuit glitch, November 4th for weather, and November 5th for a gaseous hydrogen leak.  After the November 5th delay, crews discovered a  crack in the insulating foam, necessitating repairs before the launch.  These delays pushed the shuttle launch out of the available November launch window.  The next launch window is from December 1st through 5th, which gives the shuttle experts slightly less than a month to prepare for launch, or the mission may be delayed until next year. 

Although not a lot of information has been released about the specific issues that have delayed the launches, we can put what we do know into a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  Once more information is released about the specifics of the issues that delayed the launch, more detail can easily be added to the Cause Map to capture all the causes for the delay.  Additionally, the timeline can be updated to reflect the date of the eventual launch.  

To view the problem outline, Cause Map, and launch timeline, please click on “Download PDF” above.

 The Space Shuttle Discovery is expected to be launched November 4th, assuming all goes well.  But what does “all going well” entail?  Some things are obvious and well-known, such as the need to ensure that the weather is acceptable for launch.  However, with an operation as complex and risky as launching a shuttle, there are a lot of steps to make sure that the launch goes off smoothly.

 To show the steps involved in shuttle launch preparation, we can prepare a Process Map.  Although a Process Map looks like a Cause Map, its purpose is to show the steps that must be accomplished, in order, for successful completion of a process.  We can begin a Process Map with only one box, the process that we’ll be detailing.  Here, it’s the “Launch Preparation Process”.  We break up the process into more detailed steps in order to provide more useful information about a process.  Here the information used was from Wired Magazine and NASA’s Launch Blog (where they’ll be providing up-to-date details as the launch process begins). 

Here we break down the Shuttle Launch Process into 9 steps, though we could continue to add more detail until  we had hundreds of steps.  Some of the steps have been added (or updated) based on issues with previous missions.  For example, on Apollo I, oxygen on board caught fire during a test and killed the crew.  Now one of the first steps is an oxygen purge, where oxygen in the payload bay and aft compartments is replaced with nitrogen.  On Challenger, concerns about equipment integrity in extremely cold weather were not brought to higher ups.  Now there’s a Launch Readiness Check, where more than 20 representatives of contractor organizations and departments within NASA are asked to verify their readiness for launch.  This allows all contributors to have a say regarding the launch.  One of the last steps is the weather check we mentioned above.  

 Similar to the Launch Readiness Check, we can add additional detail to the Launch Status Check.  This step can be further broken down to show the checks of systems and positions that must be completed before the Launch Status step can be considered complete.  Each step within each Process Map shown here can be broken down into even more detail, depending on the complexity of the process and the need for a detailed Process Map.  In the case of an extremely complex process such as this one, there may be several versions of the Process Map, such as an overview of the entire process (like we’ve shown here) and a detailed version for each step of the Process to be provided to the personnel who are performing and overseeing that portion of the process.  As you can see a lot of planning and checking goes into the launch preparations!

Following the successful rescue of all 33 miners trapped in a Chilean mine is some unhappy mine news from China.  A gas blast on October 16, 2010 in the early morning is known to have killed 26 miners, and the 11 miners unaccounted for are believed dead.   In addition to these impacts to the safety goals, the environmental goal is impacted by the extremely high levels of methane gas, the customer service and production goals are impacted by the closure of the mine, and the property and labor goals are impacted by the rescue efforts that have been required.  Unfortunately this is not an uncommon occurrence.  It is estimated that 2,600 people were killed in Chinese mine accidents last year. 

 It is expected that the miners were mostly killed due to suffocation.  In addition to the lack of oxygen from the extremely high levels of methane (40% compared to the normal level of 1%), the miners were buried by coal dust, released by the gas blast.  The miners were trapped in the mine by the gas blast, of which the cause is as of yet unknown.  This is a question that additional investigation will try and answer.  Additionally more information is needed about the high levels of methane.  The rescuers had difficulty reducing the levels of methane because coal dust was blocking an access shaft, but levels were high prior to the blast, for reasons that are unclear.

More detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  Because of the high number of deaths (and the high frequency of this type of incident), the Cause Map should end up very detailed in order to provide as many solutions as possible to ensure that the best solutions are implemented to reduce these types of incidents.

On October 13, 2010, after almost 70 days spent at 688 meters underground, the 33 miners who were trapped in Chile’s San Jose Mine were brought to the surface in a small rescue capsule. Although the complexity of this rescue mission was unmatched in history, it seemed to go off without a hitch, even allowing the rescue to proceed more quickly than anticipated.

The primary concern throughout the rescue was the miner’s safety. Plans for the rescue focused on ensuring the safest possible environment for the miners – and making adjustments based on the ordeal they’ve been through. For example, there was concern about damage to the miner’s eyes – they haven’t been exposed to natural light for a while. So the miners wore protective eyewear to prevent damage. In addition, medics and rescuers were sent down to the chamber where the miners had been trapped to prepare them for the trip up (in a rescue pod small enough to fit through a 60-cm diameter hole) and evaluate them for medical conditions. After the miners reached the surface, they will receive 48 hours of medical observation by a team of specialists.

The preparations for this undertaking have been extremely methodical and detail. An area near the mine exit was cleared for a helicopter landing – a backup plan in case anything should happen so that the miners would be unable to be transported to the medical facility by road.

Even less-immediate concerns have been considered. The company that owned the mine went bankrupt while the miners were trapped, meaning these brave men returned to the surface jobless. The Chilean government put out a notice, and has received more than a thousand job offers.

One of the biggest concerns is that the miners will suffer from post-traumatic stress disorder (PTSD). It’s unclear exactly what exactly is being – or can be – done to reduce the impact, but the Chilean government has consulted with NASA about potential emotional and psychological issues the miners will face.

It seems that the rescuers really tried to think of everything that would make the rescue go smoothly – and the result of this planning showed in the faces of millions who watched the last miner safely pulled from the mine. A big Bravo Zulu out to all involved!

(You can see a timeline of the events starting from the mine collapse and a Cause Map that shows some of the worries the rescuers considered – and planned for – by clicking “Download PDF” above.)

On Monday, October 4, 2010, a massive wave of red sludge flooded into four villages near Kilontar, Hungary when a storage reservoir burst.  Four were killed and at least 150 have needed medical treatment for their injuries.  The most common injuries reported are burns and eye ailments. 

Red sludge is a highly caustic material that is produced during the aluminum manufacturing process.  Reports indicate that the sludge had a pH of 13 while stored in the reservoir.  All life has been killed in a 25 mile stretch of river and 16 square miles of land have been covered by the pollution.  Best estimates are that 158 million to 184 million gallons of sludge were released.  This first large scale release of red sludge in history.

Hungary’s top investigative agency is looking into the accident, but the cause for the reservoir barrier failure is not known at this time.

Even with the unknowns, a root cause analysis can be started by creating a Cause Map and documenting all available information.  Any new information can easily be incorporated into the existing Cause Map.

To build a Cause Map, we start with the impacted goals and ask “why” questions.  In this example, the two goals we will consider are the Safety goal and the Environmental goal.  Starting with the Safety goal we begin by asking – Why were people injured?  They were injured because they were exposed to caustic material because red sludge flooded into their villages.  Why?  Because red sludge was stored in a nearly reservoir and the barrier on the reservoir was breached.

Why the barrier failed isn’t known, but we can still add additional information that might be useful.  We know that the red sludge reservoir was near the villages and a little research reveals that this is common practice in the region and that there are a number of similar pools nearby.  This information may become relevant if the investigation determines that the other reservoirs are at risk for a similar failure so it’s worth recording on our Cause Map at this point. There is also information available about the environmental impact that can be added. 

The investigation is still incomplete, but the Cause Map can grow as more information comes available.  Once the relevant information is added, the Cause Map can be used to develop solutions to help prevent similar accidents from occurring in the future.

On Sunday (September 26^th, 2010) the lead investigator for the Deepwater Horizon oil spill was questioned by a National Academy of Engineering committee.  The committee brought up concerns that the investigation that had been performed was not adequate to address all the causes of the spill.  Said the lead oil spill investigator: “It is clear that you could go further into the analysis . . . this does not represent a complete penetration into potentially deeper issues.” 

Specifically, the committee was concerned that the study focused on decisions made on the rig (generally by personnel who worked for other companies) but did not adequately consider input from these companies.  The study also avoided organizational issues that may have contributed to the spill.

 In circumstances such as this one – where an extremely complicated event requires an organization to spend most of its resources fixing the immediate problem, an interim report – which may not delve deeply into underlying organizational issues or obtain a full spectrum of interviews – may be appropriate.  However, it’s just an interim report and should not be treated as the final analysis of the causes relating to an issue.  The organizations involved need to ensure that after the immediate actions – stopping the spill, completing the cleanup, and compensating victims – are complete, an in-depth report commensurate with the impact of the issue is performed.

 In instances such as these, causes relating to an incident need to be unearthed ruthlessly and distributed freely.  This is generally why a governmental organization will perform these in-depth reviews.  The personnel involved in the investigation must not be limited to only one organization, but rather all organizations that are involved in the incident.  Once action items that will improve safety and processes have been determined, they must be freely distributed to all other organizations participating in similar endeavors.  The alternative – to wait until similar disasters happen at other sites – is unacceptable.

Two Iowa farms have recently been at the center of the largest egg recall in US history.  Over half a billion eggs were recalled in August after more than 1,500 people were sickened by eggs tainted with salmonella.

How did this happen?  Where did the contamination come from?  How did tainted eggs make it onto supermarket shelves?

The investigation is still ongoing, but we can begin a root cause analysis of this problem by building a Cause Map.  A Cause Map provides a simple visual explanation of all the causes that were required to produce the incident.  A good place to start building a Cause Map is to identify the impacts to the organizational goals.  Causes are then added to the map by asking “why” questions.  (Click on the “Download PDF” button to view a Cause Map of this issue.)

In this example, we’ll consider the safety goal first.  The safety goal was impacted because nearly 1,500 people got sick because they consumed eggs that were contaminated with salmonella.  Why did they eat contaminated eggs?  Contaminated eggs were eaten because they were sold.  Why?  Because the eggs were contaminated at some point and there was inadequate regulation to prevent them from being sold. 

Investigators are still determining the exact source of the contamination, but there is significant information available that can be added to the Cause Map.  The eggs were contaminated with salmonella because the hens laying the eggs were contaminated. (This strain of bacteria can be found inside a chicken’s ovaries and is passed on to eggs.)  The exact source that contaminated the hens is still being determined, but testing by the FDA has determined that the hens were likely contaminated after arriving at the farms.  FDA investigators have found a number of sanitation violations, including rodents which are a known carrier of salmonella.  Salmonella is not passed from hen to hen, but is typically passed from rodent droppings to chickens. 

As more information comes available we can add to the Cause Map.  Hopefully, the investigation will result in solutions that can be applied and prevent this situation from occurring again.

Investigating the recent massive oil spill in the Gulf of Mexico is a tall order.  There are many contributing causes and a multitude of creative solutions are going to be needed to restore the environment.

During any investigation of this magnitude, there are guaranteed to be a few surprises.  And the Deep Horizon oil spill is no exception.

Scientists have discovered a previously unknown type of oil-eating bacteria feasting on oil from the spill.

This microbe is unique from previously studied varieties because it doesn’t consume large quantities of oxygen along with the oil.  Oxygen consumption is a concern because oxygen is needed in the sea to support life.

This microbe also thrives in cold water temperatures associated with the deep ocean, which might explain why it hasn’t been seen before.  Some scientists are theorizing that the microbe adapted in the deep ocean to consume the oil that naturally seeped from the ocean floor.  Since the huge influx of oil to the water, the bacteria populations have exploded.

Scientists are in a disagreement over how much oil remains in the Gulf, but there is no doubt that less is better. 

This serendipitous solution is a welcome addition to the clean up efforts.  Obviously, there are many other solutions that will needed, but anything that safely reduces the overall amount of oil is a positive development.  Hopefully, with some additional research this microbe could be a potential solution to future incidents.

When performing an investigation, the unexpected sometimes happens.  The better understood the problem is, the easier it is to adapt to any new information. The Cause Mapping method of root cause analysis is an effective way to organize all information needed during an investigation.  Clearly understanding the causes that contribute to an incident will allow an organization to adapt as new information comes available and make sure that resources are used in the most efficient ways when implementing solutions.

(This week, we are proud to announce a Cause Map by a guest blogger, Bill Graham.  Thanks, Bill!)

While completing household chores in the spring of 2010, a Housewife found her front load washing machine stopped with water standing in the clothing.  Inspection of the machine uncovered the washing machine’s drain pump had failed.  Because the washer is less than two years old, it was decided to attempt repair of the machine instead of replacing it.  A replacement pump was not locally available, so the family finds and orders a pump from an Internet dealer.  Delivery time for the pump is approximately one week, during which time the household laundry chore cannot be completed and some of the family’s favorite clothing cannot be worn because it is has not been laundered.  On receiving the new pump, Dad immediately removes the broken pump and finds, to his chagrin, a small, thin guitar pick in the suction of the old pump.  Upon discovery of the guitar pick, the family’s children report that the pick had been left in the pocket of the pants that where being washed at the time of the pump’s failure.  The new pump was installed and the laundry chore resumed for the household.

While most cause analysis programs would identify the guitar pick as the root cause to the washing machine’s failure, Cause Mapping unveils all of the event’s contributing factors and what most efficient / cost effective measures might be taken to avert a similar failure.  For example, if all the family’s children aspire to be guitar players, then a top load washer may better suit their lifestyle while also averting the same mishap.  Or, maybe the family should consider wearing pocket-less clothing.  Or, maybe all family members should assume bigger role in completing the household laundry chore.  Whichever solution is chosen, the impact of these and all contributing causes is easily understood when the event is Cause Mapped.

The objective of a root cause analysis investigation is to prevention.  The causes of an incident are investigated, so that solutions can be developed and implemented, to reduce the risk of the same or a similar problem from occurring.  The process sounds easy, but in practice it can become more involved.  For example, what do you do when one of the identified causes is “lack of safety culture”?  How exactly do you solve that? 

This is the issue that the Washington DC Metrorail (Metro) is currently facing.  The National Transportation and Safety Board (NSTB) recently released findings from the investigation of a DC metro train crash that killed nine last June.  (See our previous blog for more details). Predictably, the NSTB findings include several technical issues including failed track circuits and lack of adequate testing, but the list of causes also includes items like lack of safety culture and ineffective oversight. 

Fortunately, the NSTB also provided recommendations such as developing a non-punitive safety reporting program, establishment of periodic inspections and maintenance procedures for the equipment that failed during this accident, and reviewing the process used to pass along safety and technical information.  One of the important things to notice in this example is that the recommendations are fairly specific, even if the stated cause is a little vague.  Specific solutions are necessary if they are going to be effectively implemented.

 If you find yourself at a point in your organization where a cause is identified as “lack of safety culture”, it’s a good idea to keep asking why questions until you identify the specific problems that are causing the issue.  Is it the safety information that is lacking or incorrect?  Is the process that provides the information confusing?  Do the workers need better safety equipment?  Knowing all the details involved will allow better solutions to be developed.  And better solutions result in lower risks in the future.  Culture is the shared values and practices of the people in an organization.  The Cause Mapping method of root cause analysis has an effective way for an organization to identify “culture gaps” by thoroughly dissecting just one of its incidents.

Astronauts at the International Space Station ran into problems during a planned replacement of a broken ammonia cooling pump on August 7, 2010.  In order to replace the pump, four ammonia hoses and five electrical cables needed to be disconnected to remove the broken pump.  One of the hoses could not be removed because of a jammed fitting.  When an astronaut was able to disconnect it by hitting the fitting with a hammer, it caused an ammonia leak. 

Ammonia is toxic, so the leak impacted both the safety and environmental goals.  Because the broken pump kept one cooling system from working, there was a risk of having to evacuate the space station, should the other system (which was the same age) fail.  This can be considered an impact to the customer service goal.   The repair had to be delayed, which is an impact to the production/schedule goal.  The loss of a redundant system is an impact to the property/equipment goal.     The extended spacewalk is an impact to the labor/time goal. 

Once we fill out the outline with the impact to the goals and information regarding the problem, we can go on to the Cause Map.   The ammonia leak was caused by an unknown leak path and the fitting being removed by a hammer.  The fitting was removed with a hammer because it was jammed and had to be disconnected in order for the broken pump to be replaced.  As we’re not aware of what caused the pump to break (this information will likely be discovered now that the pump has been removed), we leave a question mark on the map, to fill in later.

The failed cooling pump also caused the loss of one cooling system.  If the other system, which is near the end of its expected life, were to fail, this would require evacuation from the station.  

To aid in our understanding of this incident, we can create a very simple process map of the pump replacement.  The red firework shows the step in the replacement that didn’t go well.  To view the outline, Cause Map and Process Map, click on “Download PDF” above.

The Therac-25 is a radiation therapy machine used during the mid-80s.  It delivered two types of radiation beams, a low-power electron beam and a high-power x-ray.  This provided the economic advantage of delivering two kinds of therapeutic radiation with one machine.  From June 1985 to January 1987, the Therac-25 delivered massive radiation overdoses to 6 people around the country.  We can look at the causes of these overdoses in a root cause analysis performed as a Cause Map. 

The radiation overdoses were caused by delivery of the high-powered electron beam without attenuation.  In order for this to happen, the high-powered beam was delivered, and the attenuation was not present.  The lower-powered beam did not require attenuation provided by the beam spreader, so it was possible to operate the machine without it.  The machine did register an error when the high-powered beam was turned on without attenuation.  However, it was possible to operate the the beam with the error and the warning was overridden by the operators.

The Therac-25 had two different responses to errors.  One was to pause the treatment, which allowed the operators to resume without any changes to settings, and another was to reset the machine settings.  The error resulting in this case, having the high-power beam without attenuation, resulted only in a treatment pause, allowing the operator to resume treatment with an override, without changing any of the settings.  Researchers talking to the operators found that the Therac-25 frequently resulted in errors and so operators were accustomed to overriding them.  In this case, the error that resulted (“Malfunction 54″) was ambiguous and not defined in any of the operating manuals.  (This code was apparently only to be used for the manufacturing company, not healthcare users.) 

The Therac-25 allowed the beam to be turned on without error (minus the overridden warning) in this circumstance.  The Therac-25 had no hardware protective circuits and depended solely on software for protection.  The safety analysis of the Therac-25 considered only hardware failures, not software errors, and thus did not discover the need for any sort of hardware protection.  The reasoning given for not including software errors was the “extensive testing” of the Therac-25, the fact that software, unlike hardware, does not degrade, and the general assumption that software is error-proof.  Software errors were assumed to be caused by hardware errors, and residual software errors were not included in the analysis.

Unfortunately the coding used in the Therac-25 was in part borrowed from a previous machine and contained a residual error.  This error was not noticed in previous versions because hardware protective circuits prevented a similar error from occurring.  The residual error was a software error known as a “race condition”.  In short, the output of the coding was dependent on the order the variables were entered.  If an operator were to enter the variables for the treatment very quickly and not in the normal order (such as going back to correct a mistake), the machine would accept the settings before the change from the default setting had registered.  In some of these cases, it resulted in the error described here.  This error was not caught before the overdoses happened because software failures were not considered in the safety analysis (as described above), the code was reused from a previous system that had hardware interlocks (and so had not had these problems) and the review of the software was inadequate.  The coding was not independently reviewed, the design of the software did not include failure modes and the software was not tested with the hardware until installation.

This incident can teach us a lot about over-reliance on one part of a system and re-using designs in a new way with inadequate testing and verification (as well as many other issues).  If we can learn from the mistakes of others, we are less likely to make those mistakes ourselves.  For more detail on this (extremely complicated) issue, please see Nancy Leverson and Clark Turner’s “An Investigation of the Therac-25 Incidents.”

Research is been suspended at a prominent brain-imaging center associated with Columbia University.  Food and Drug Administration investigations found that the Kreitchman PET (positron emission tomography) Center has injected mental patients with drugs that contained potentially harmful impurities repeatedly over the past four years.

Investigations by the lab determined that no patients were harmed from the impurities, but this is still a significant issue in a nationally renown laboratory.

 How did this happen?

This issue can be investigated by building a root cause analysis as a Cause Map.  To start a Cause Map, the impact to the organization goals is determined.  In this example, this issue is obviously an impact to safety because there was potential to harm patients.  It is also an impact to the production-schedule goal because research has been suspended.  Additionally, this problem is an impact to the customer service goal because this issue raises questions about the validity of research results.

To build a Cause Map, select one goal and start asking “why” questions to add causes.  In this case, the first goal considered will be the safety goal.  There was a potential for injury.  Why?  Because impure injections were given to patients.  Why?  Because the injections are necessary for research, because the labs typically prepare the compounds themselves and because the lab prepared the compounds incorrectly.  When there is more than one causes that contributed, the causes are added vertically with an “and” between them.

Each impacted goal needs to eventually connect to the same Cause Map.  If they do not, the impacted goal may not be caused by the same problem and the goals should be revisited.

To continue building the Cause Map, keep asking “why” questions for each added cause until the level of detail is sufficient.

A Cause Map can be as high level or as detailed as needed.  The more significant the impact to the goals, the more likely a detailed Cause Map will be warranted.  Once the Cause Map is completed, it can be used to develop solutions to help prevent the problem from reoccurring.

In this example, the lab is currently changing management and reorganizing procedures to help prevent the similar problems in the future. 

To view an initial Cause Map for this issue, please click the “Download PDF” button above.

Last Wednesday, another set back occurred in the attempt to stem the flow of oil in the Gulf of Mexico from the a well head that was damaged when the Deepwater Horizon Oil Rig exploded on April 20 and sank 36 hours later .

The containment cap used to siphon oil from the damaged well head for the last three weeks had to be temporarily removed for more than 11 hours.  Before being removed, the containment system was sucking up about 29,000 gallons an hour.

So what happened?  Why remove a containment cap that had been working successful?

A root cause analysis of this problem can be built as a Cause Map.  A Cause Map is started by considering the impact to the goals and asking “why” questions to add Causes.  In this example, the first goal we will consider is the Environmental Goal.  Obviously, the environmental goal is impacted because there was additional oil released to the environment because the cap was removed. 

Continuing to ask “why” questions we can add additional causes.  The cap was removed because the ship connected to the containment cap system needed to be moved away from the well because there a safety concern because of the potential for an explosion.

There was an explosion concern because there was evidence that flammable gas was flowing up from the well head because liquid was being pushed out of a valve in the containment system.  This gas was getting into the containment cap system because an underwater vent was bumped by one of the remote-controlled submersible robots being used to monitor the damaged well.

More detail could be added to the Cause Map by continuing to ask why questions.  The detailed Cause Map could then be used to develop solutions that could be implemented to help prevent the problem from reoccurring.

Click on the “Download PDF” button above to view an initial Cause Map.

The containment cap was put back into place around 9 pm on June 23.  The efforts to contain and clean up the oil spill will continue for months and possibly years to come, but at least this small issue has been fixed.

A coal mine explosion in Amaga, Colombia on June 16, 2010 has left at least 18 dead, 1 injured and at least 53 people unaccounted for, and presumed dead.  The deaths and injuries resulted from a fireball caused by an explosion.  

Every explosion is caused by four factors: heat, fuel, oxygen and confinement.  In this case, the fuel was methane gas that had built up in the mine.  Methane is naturally produced as a byproduct of coal mining.  The methane was not removed from the mine because the mine lacked a methane ventilation pipe.  Additionally, the workers at the mine did not realize that methane levels were high because there was no gas detection system at the mine.

The number of dead and missing is so high because more people than usual were at the mine – the explosion happened during shift change.  Rescue efforts have been delayed by the high levels of gas in the mine, further increasing the number of deaths. 

By clicking “Download PDF” above, you can view the thorough root cause analysis built as a Cause Map in a simple, intuitive format that fits on one page.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

On May 25, 2010, the National Highway Traffic Safety Administration (NHTSA) released new data about Toyota’s unintended acceleration issues, increasing the number of deaths potentially linked to the issue to 89.  Additionally, the NHTSA stated that nearly 6,200 complaints regarding acceleration issues in Toyotas have been received since 2000.

The acceleration issues have already resulted in massive recalls of Toyota vehicles in the US.  Nearly 5.4 million vehicles were recalled to fix issues with floor mats that could potentially shift out of position and an addition 2.3 million vehicles were recalled to repair sticking accelerator pedals.  No additional causes have been found for the acceleration issues at this time, but there are a wide range of theories that include electronic issues and solar flares.  Toyota denies that there are any additional causes of the acceleration at this time.

The US government is continuing to investigate the claims of unintended acceleration in Toyotas and an independent 15-month study by the National Academy of Sciences will begin in July.

A recent Wall Street Journal article discussed one of the stranger trends that have been found in the Toyota car crash data.  There have been an unusual number of accidents at beauty salons. 

Why beauty salons?

Just like any problem, this issue can be investigated using a root cause analysis built as a Cause Map.  In this case, the Safety goal would be impacted because there is a potential for injury for both the driver and people inside the salon.  Additional causes can be added to the Cause Map by, asking “why” questions and adding boxes to the right.

In this example, the article speculates that the some of the potential causes may be the age of the drivers involved (older women tend to visit salons more frequently), location of the salons (many are in strip malls near parking lots) or the architecture of salons (many have large glass windows that might distract drivers).  No formal investigation has been done to determine the actual causes of this strange trend, but it is interesting to lay out the potential causes and see what factors might be contributing to the hair salon car crashes.

Click on the “Download PDF” button above to view the initial Cause Map.

On April 20, 2010 about 10 pm a huge explosion rocked a semi-submersible drilling oil rig about 40 miles off the coast of Louisiana in the Gulf of Mexico. The oil rig was called the Deepwater Horizon and was owned by Transocean Ltd and leased to the British Petroleum Company through September 2013.

The oil rig burned for about 36 hours before sinking.  126 people were on the oil rig at the time of the explosion.  Eleven are missing and presumed dead and 4 were critically injured. Oil continues to leak from the wellhead more than a mile underwater on the ocean floor at an estimated rate of 42,000 gallons a day.

Remotely operated submersible vehicles were used to examine the wellhead.  The vehicles were also used in an effort to manually trigger the blowout preventer, which would close the wellhead and prevent any farther release of oil.  The blowout preventer is a 450-ton valve installed at the wellhead that is designed to automatically shut to prevent oil leaks in the event of an accident.  Attempts to manually close the blowout preventer have not been successful.

The other containment options being explored are drilling a separate well nearby to plug the flow at a location below the blowout preventer and building underwater domes that would contain the oil until it could be safely pumped to the surface for disposal.  Both of these alternatives are being actively worked and will take months to complete.  It is estimated that 4.2 million gallons of oil will be released if the blowout preventer is not able to be closed.

The cause of the explosion is unknown at this time.  An investigation is underway by the Coast Guard and the Minerals Management Service. 

A preliminary root cause analysis can be started using the information that is known and details can be added as they become available.  The analysis can be documented using a Cause Map which is a simple, intuitive format that visually lays out all known causes for an incident.  The first step in building a Cause Map is to determine how the organizational goals were impacted by the incident.  Causes for each impacted goal are determined to begin building the Cause Map.

In this case, the safety goal was impacted because 11 people were killed and several injured.  The environmental goal was impacted because there was a significant oil release.  The materials goal was impacted because the $700 million oil rig is a complete loss and the production/schedule goal was impacted because the oil drilling operation is shut down. 

Click on the “Download PDF” button above to view an initial Cause Map.

In 1922 the United Nations designated March 22 as World Water Day.  In honor of the occasion, a report titled “Sick Water” was published this week detailing issues with water pollution throughout the globe.

According to the report, two billion tons of pollution consisting of human and animal waste and industrial chemicals are dumped into waterways every day.  Almost 80 percent of sewage around the globe goes into waterways untreated. 

Millions of people lack basic infrastructure including access to clean water, sanitation systems and water treatment facilities. The massive water pollution that results from this situation kills nearly 1.5 million children under age 5 every year.  Over half of the hospital beds in the world are occupied by people with illnesses caused by drinking contaminated water.

Even in developed nations, water pollution is a problem because many chemicals aren’t removed by the water treatments that kill the pathogens from sewage.  Chemicals from antidepressants, birth control, illegal drugs, sunscreen, and insect repellent are just some of the pollutants that have been found in US drinking supplies.

In addition to human illnesses caused by dirty water, water pollution has a large scale impact on the environment.  Over two billion tons of water is polluted daily, resulting in death of fish and choked coral reefs.

While the problem of water pollution isn’t a problem that is traditionally approached by root cause analysis, a Cause Map can be built to examine the causes of a wide range of issues.  Click on the “Download PDF” button to view a high level Cause Map of this issue.  The Cause Map could be expanded to incorporate as many causes as desired.

A number of food products have been recalled recently because of potential salmonella contamination.  The recall list is still growing and has the potential to affect thousands of items in nearly every aisle at the grocery store. 

The contamination originated in hydrolyzed vegetable protein (HPV) which is a common, inexpensive salty and savory flavor enhancer used in a variety of products.  All HPV from Basic Food Flavors of Las Vegas made since September 17, 2009 has been recalled.   For a list of all recalled items and more information, please visit the Food and Drug Administration webpage.

The salmonella contamination occurred in the processing equipment at a one location, but HPV from that supplier was sold to food manufacturers nationwide.  HPV is a specialized product and there are only a few suppliers for it so issues at a single supplier have the potential to affect a significant percentage of the processed food supply. 

The contamination was identified when a consumer of the Basic Food Flavors identified salmonella in a batch of HPV they had purchased and reported it to the FDA, utilizing the new FDA Reportable Food Registry.  The FDA then inspected Basic Food Flavors and found salmonella in the plant’s processing equipment.  

The overall risk to the public is considered low.  No cases of illness from this contamination have been reported.  As long as products are heated to a sufficient temperature, either during the manufacturing process or cooked after purchase, the salmonella risk will be eliminated.  The highest risk products are ready to eat products such as chips, dips, and dip powder.

The investigation of this incident is still ongoing, but a basic root cause analysis can be started.  The safety goal is obviously impacted since salmonella can potentially cause illness and even death in the case of weakened immune systems.  In this case, the customer service goal would be impacted as well because the recall may affect customer confidence and sales of the recalled items.

Click on the “Download PDF” button to view an initial Cause Map of the salmonella contamination.  The Cause Map can be expanded as more details are available.

On February 12, 2010, Nodar Kumaritashvili, an Olympic luger from the country of Georgia, was killed during a practice run.  He lost control of his sled, flew off the track and hit a steel pole.

The investigation into the accident is still ongoing, but a root cause analysis can be started with the information that is available.  This accident obviously impacts the safety goal because an athletic was killed and it also had potential to impact the schedule goal because the track was closed during the initial investigation.

There are a number of causes that can be added to the Cause Map.  One of the more obvious causes for the accident is that the athletic was traveling at high speeds.  This occurred because the crash happened near the bottom of the track so the sled was near its top speed.  Additionally, the Vancouver Olympic track is also a particularly fast track.  Top speeds on the track were predicted to be 96 mph, nearly 6 miles faster than the standing 2000 world speed record.

How did the track get designed to be so much faster than typical tracks?  There are a number of causes that contributed to fast design.  The designers choose Whistler as the site of the track because Whistler has a colder climate than the alternatives, resulting in firm, fast ice and because there is high tourist traffic there that would help make the track a commercial success after the Olympics.  Whistler was also the site of the Olympic alpine events.

The land that was available at Whistler was long and narrow.  The site was a valley approximately 100 yards by 800 yards.  By comparison, the Calgary track was about 300 yards wide and Salt Lake City’s track was 500 yards.  Designing a track to fit in the available region meant the track couldn’t include any long curves that slow down speed as is typical. 

The result was the fastest track in the history of the sport.

As the investigation continues, more details become available and they can be added to the Cause Map.

In order to ensure safety during the Olympic Games, several solutions were implemented following the accident. A wooden wall was added to the curve where the accident occurred to keep athletics on the track, the steel poles were padded and events were started lower on the track to limit the maximum speed.  The lower start was predicted to slow top speeds in the men’s events by about 5 mph.

There have been several crashes on the course since the accident, but thankfully no farther significant injuries have occurred.

On February 12, 2010 at approximately 10:13 A.M., a six-car Red Line Metro train taking passengers to Shady Grove derailed near the Farragut North station in Washington, D.C.  If you’ve been reading our blog, you’ve seen our reports on three previous Metro incidents in the past year (two Metro workers were killed in January, two trains collided last November, and two trains also collided last June).

Thankfully, this derailment caused only minor injuries.  However, it did result in an extremely messy commute for a lot of people, due to a severe delay in train service.  Additionally, there was likely damage to the train and/or track, which will require labor to repair.  More labor will be required for the investigation. 

All the basic information, as well as the impacts to the goals (the injuries, delay in service, property damage and labor required as a result of the incident), relating to this event are captured in a problem outline.  We can also capture anything that was different at the time.  Here we note that there were major storms in the area and that the commute was especially heavy. 

Once we have completed the outline, we can begin the Cause Map with the goals that were impacted.  The impacts to the goals resulted from the train derailing.  The train derailed when the front wheels slipped and the lead car came off the track.  Metro and National Transportation Safety Board (NTSB) investigators are determining the causes of the derailment, but some of the things that will be looked at as causes include: the train was moving onto a pocket track.  Other trains previously have slipped off the track while moving onto a pocket track (a side track that allows trains to pass other trains or move around construction).  It’s unclear whether the train was moving onto the pocket track to move around other trains or track work.

As previously mentioned, the snow and icy conditions (which have been extreme as of late in D.C.) may have caused the tracks to be slippery, which potentially contributed to the derailment.  It’s possible there was damage to the tracks or switch, as the area where the derailment took place is the oldest portion of the Red Line, and is due for maintenance.  Because of an extreme budget shortfall on the Metro line, repairs to tracks and cars have been delayed.  Last but not least, there’s a possibility that the weight of the rail car may have been a factor in the derailment.  The cars were extremely crowded because of an insufficient number for the commute.  Metro was not running the normal number of cars because it had not completely recovered from the storm, but there were the normal number of commuters because the Federal Government was open.  (The Federal Government usually remains closed when the Metro system is unable to run at full capacity.)    

Even though we are not yet certain which factors may have contributed to the derailment, we can include them all on the Cause Map until we are able to rule some of them out.  Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  View the beginning stage of the root cause analysis investigation by clicking on “Download PDF” above.

A new potential safety issue has developed and Toyota may recall the newest model of the gas electric hybrid Prius that has been sold since last May.  The National Highway Traffic Safety Administration has received 124 reports from consumers claiming that the brakes don’t engage immediately at times.  Toyota has stated that the company has received 180 reports of braking problems in Japan and the United States. The reports include 4 incidents that resulted in accidents with 2 people receiving minor injuries.

Even a slight delay in the response of car braking systems can be very dangerous because cars can travel nearly 100 feet in one second at highway speeds.

No official details are known yet on what is causing the delay in brake engagement.  In one article, a power train expert speculated that it was a software glitch caused when the hybrid switched between using the electric motor and the internal combustion engine.  In the Prius design, the same motor that is powering the car, powers the brakes.  When the hybrid is switching between motors, there might be a momentarily loss of power to the brakes during the transition.

A preliminary root cause analysis can be started using the available information.  The Cause Map can be expanded and revised as necessary as new information becomes available.  Click on the “Download PDF” button above to view the initial Cause Map.

Toyota has not stated whether a formal recall will be made.  A potential recall would affect 300,000 vehicles worldwide.

This new issue comes on the heels of a major announcement on January 21 where 2.3 million cars were recalled because of sticky gas pedals that can cause sudden acceleration. Additionally, there was a recall issued in September 2009 because there was a potential for floor mats to move out of place and cause the accelerator to stick. (A previous blog addressed this issue.)

Toyota shares dropped 21 percent following the January announcement and any farther safety issues will likely negatively impact consumer confident and stock prices.

Just before rush hour began on Monday, February 1, 2010, traffic was stopped for a different reason – a plane landed in the median and then skidded off the road.  Thanks to quick thinking and the exemplary control of the pilot, nobody was hurt, though the plane did suffer considerable damage.  As with any incident, we can look at what happened and the effects in a Cause Map, or a visual root cause analysis.

First we record the specifics of the incident, such as date, time, place, equipment and process involved.  There’s also space to write if anything was different, though in this case it’s not clear what any differences were, so we can just enter a “?” to show we’re not sure. 

Next we define the incident with respect to the organization’s goals.  Although nobody was hurt, an emergency landing (especially when the plane is damaged) has the potential to cause injuries.  These potential injuries are an impact to the safety goal.  There was significant traffic back-up after the incident, which is an impact to both the customer service and the production/schedule goal.  Last but not least, the damage to the plane is an impact to the property goal.  It’s unclear whether there was an impact to the environmental or labor/time goal, so we’ll put a “?” here, too.  

Once we’ve defined the impact with respect to the goals, we can begin with those impacted goals to make our Cause Map.  The impact to the safety and property goals occurred when the plane hit trees on the side of the road.  This happened because the rear wheel of the aircraft caught in the muddy median, where the pilot landed to avoid traffic, AND because the plane made an emergency landing on the New Jersey Turnpike.  (The emergency landing caused rubbernecking, which impacted the customer service and production goals.)  The plane required an emergency landing because it was losing altitude after the loss of an engine.  (The plane was in the air giving traffic reports.)  The engine was lost because it was losing oil from a leak in the right wing fuel tank.  It’s unclear what caused the leak at this time.  The pilot chose to land on the highway because it was well lit, unlike the surrounding areas and because the traffic was light since rush hour had not yet begun.     

As you can see on the downloadable PDF, a thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  We can build a significant portion of the Cause Map even with the little information that is currently available.  Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  (Click on “Download PDF” to view the beginning of the root cause analysis investigation.)

On January 26, 2010 just before 2 am, two Metro workers were killed near the Rockville metro station.  They were crushed by a metro utility vehicle while working on the track to install safety equipment.

The utility vehicle is a gas powered truck that is designed to operate on the track when electricity is shut off.  They are called high-rail vehicles and are typically used to carry equipment.  At the time of the accident, the vehicle was placing devices that tell approaching trains that there is a work crew in the area.

Many details of this accident are not available yet, but a preliminary root cause analysis can be started.  The basic information can be documented in an Outline and an initial cause map can be started.  Click on the “Download PDF” button above to see what this would look like.

The men killed and the workers in the vehicle were not part of the same crew and it’s not clear why the driver of the truck wasn’t aware that workers were in the area.  At the time of the accident the vehicle was traveling in reverse, which is a routine mode of operation.

Safety regulations require all vehicle operators to be informed about work crew locations, but it isn’t clear if that is being done effectively.

The National Transportation Safety Board (NTSB) has begun to investigate this incident and more details should be available as their investigation progresses.   The NTSB is currently reviewing employee work history and training and gathering all relevant data such as radio recordings and work procedures.

The DC Metro system has the worst safety record of any metro system in the country.  Five workers have now been killed while on the tracks in the last seven months.  There was also a metro train accident that killed 9 people on June 22, 2009.  To see a cause map of the June accident, click here.

While researching the tragedy in Bhopal, India, I discovered that there are two theories about what occurred on December 3, 1984 that resulted in a tremendous loss of life. One theory is from a report done by an Engineering Consulting firm hired by Union Carbide (the company that owned the plant in question) that determines that the release was caused by sabotage. Theory #2 is that a combination of inexperienced, ineffective workers and a badly maintained plant with inadequate safety standards that was being ready for dismantling experienced a horribly catastrophic chain of events that ensured that anything that could go wrong, did. For completeness, I have included both in my final Cause Map (which you can see by clicking “Download PDF” above). But for now, I’d just like to focus on the second.

In the wee morning hours of December 3, 1984, over 40 tons (this amount is also debated, but 40 tons appears to be the most popular, purely based on number of references that mention it) of methyl isocyanate (MIC) were released over the community of Bhopal, India, with a population of 900,000. Partially because of the transient nature of the population, and partially due to the general obfuscation of data from all sources involved, the number killed ranges from 2,000 to 15,000. The 2003 annual report of the Madhya Pradesh Gas Relief and Rehabilitation Department stated that a total of 15,248 people had died as a result of the gas leak. Based on claims accepted by the Indian government, there were at least 500,000 injured. This led to what has been called “The World’s Largest Lawsuit”, which I assume refers to the number of people represented, and certainly not the monetary amount of the settlement, which is a paltry $470 million. After the accident, the plant, after a series of legal maneuvers, was abandoned. Extensive cleanup was required, and still has not been completed. The impact to the goals are shown in the outline on the downloadable PDF.

The deaths and environmental impact were caused by the release of over 40 tons of methyl isocyanate (from here on out, we’ll refer to it as MIC). The release occurred when a large volume of MIC was put through an ineffective protection system. The release lasted several hours, because workers were unable to stop it, and because of an ineffective warning system. The release occurred when a disk and valve that led to the protection system burst due to an increase in pressure. The increase in pressure was caused by an increase in temperature resulting from a reaction between MIC and water when the refrigeration system was shut down. There were 41 metric tons of MIC in the tank, stored for use in the plant. How the water was introduced is the debate in the two theories I mentioned above. But regardless, water got in to the tank, either by sabotage or by leaking through a vent line. We will probably never know exactly what happened. But we do know that ineffective safety systems can result in a massive loss of life, as happened here.

On January 13, 1969, 31 years ago, fires and explosions broke out on the USS Enterprise (CVN-65). The crewmembers spent three hours fighting the fire. When the smoke cleared, 27 crewmembers were killed and 314 were injured. Additionally, 15 aircraft were destroyed and the carrier was severely damaged.

We can address the impacts to the U.S. Navy’s goals in a problem outline as the first step of the Cause Mapping process. There was an impact to the safety goal because crewmembers were killed and injured. There was an impact to the property goal because of the 15 planes that were damaged, and the repairs that were required to the ship. (This is also an impact to the labor goal, because of the labor required for the repairs.) Additionally, the ship’s deployment was delayed, which is an impact to both the customer service and production/schedule goals.

After we’ve completed the outline, we build our Cause Map beginning with the goals that were impacted. The goals were impacted by a series of explosions and fires across the ship. These explosions and fires were fueled by jet fuel and bombs that were found on the planes on the flight deck of the carrier. The initiating event was the explosion of a Mk-32 Zuni rocket, which exploded when it overheated due to being put in the exhaust path of an aircraft starting unit.

After the incident, the Navy performed an investigation to review the causes of the incident, and made changes to improve safety. Repairs to the Enterprise were completed, and the ship is now the oldest active serving ship in the U.S. Navy.

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. To view the downloadable PDF, click “Download PDF” above.

In our previous blog about Flight 188 of Northwest Airlines, we discussed the first step of a root cause analysis investigation – defining the problem – and mentioned that a detailed Cause Map could be developed when more information regarding the incident was released.

The National Transportation Safety Board (NTSB) has recently released a report on what exactly happened to the flight. We can build off of the outline we already developed to put together the Cause Map, or visual root cause analysis.

First we begin with the impacts to the goals. Most importantly, the safety and property goals were impacted due to the potential danger to the flight. This was caused by the plane overshooting the destination. The pilots flew over the destination because they were distracted, warnings were not effectively delivered to them, and they couldn’t see their destination (Minneapolis-St. Paul), since it was after dark and cloudy.

The pilots were distracted by a non-operation activity. The two pilots were utilizing the scheduling software on their laptops, both of which were open in the cockpit (possibly blocking some of the flight display). Both using personal laptops and participating in non-operational activities is prohibited by the airline.

Some may ask how it’s possible that two pilots who were flying a plane – with over a hundred passengers – could be spending all their energy on another activity. Well, the pilots did not actually have any active tasks to fly the plane. The plane was on auto-pilot, and the one task that pilots ordinarily did on a regular basis (which would have certainly alerted the pilots to their position) was sending a position report. However, a dispatcher for the airliner had asked the pilots NOT to send a report, as the reports were burdensome and unneccessary.

Warnings did not effectively get through to the pilots by sight – either the flight display was physically blocked by the laptop or the pilots weren’t looking at it because they were distracted – or sound – the plane was not equipped to send audible message (such as chimes or buzzers) to the pilots, text messages sent to them were not acknowledged, and the pilots did not hear calls for them on the radio. The air traffic controllers (who were different from the air traffic controllers who had first had contact with the plane) did not know which frequency the plane was on, so only some messages got through. Because the pilots were using the speaker instead of headsets and were, again, distracted, they missed the messages.

Both of the pilots involved had their licenses revoked. Several procedures were not followed in this instance, and the FAA and individual airlines are working on highlighting the importance of these procedures. Reading about this incident (and seeing that the pilots’ license were revoked) will probably do much to highlight the importance of the procedures. Luckily, nobody was hurt for this lesson to be learned.

View the root cause analysis investigation by clicking “Download PDF” above.

On September 29, 2009, Toyota/Lexus issued a safety advisory that some 2004-2010 model year vehicles could be prone to a rapid acceleration issue if the floor mat moved out of place and jammed the accelerator pedal. Although the recall is only applicable in the U.S. and Canada because of the type of floor mats used, over 4 million vehicles are affected by the recall.

Although all the solutions to this problem have not yet been implemented, we can look at the issue so far in a Cause Map, or visual root cause analysis. First we define the problem. Here we could consider the problem the recall, or the acceleration problems. We can list all the models and years that are affected by the recall, and that the recall is limited to the U.S. and Canada.

 We define the problem with respect to the organization’s goals. There have been at least 5 fatalities addressed by the National Highway Transportation Safety Administration (NHTSA), though some media outlets have reported more. Additionally, the NHTSA has reported 17 accidents (again, some claim more) and has received at least 100 complaints. The fatalities and accidents are impacts to the safety goal. Complaints are impacts to the customer service goal. The recall of more than 4 million cars is an impact to the production/schedule goal, and the replacement of the accelerator pedals and floor mats as a result of the recall is estimated to cost $250 million, which is an impact to the property goal.

Once we’ve completed the outline, we can begin the Cause Map, or the analysis step of the process. The fatalities are caused by vehicle crashes resulting from a loss of control of the vehicle. The loss of control is caused by a sudden surge of acceleration, inability to brake, and sometimes an inability to shut down the engine of the car. Toyota says the sudden bursts of acceleration are caused by entrapment of the accelerator pedal due to interference from floor mats. Toyota refutes the possibility that there may be a malfunction in the electronic control system, saying it’s been ruled out by Toyota research.

The vehicles are unable to brake because the brake is non-functional when the accelerator pedal is engaged, as it is in these cases. Additionally, owners whose models are equipped with keyless ignition cannot quickly turn off their ignition. These models require the ignition button to be pressed for 3 seconds to prevent inadvertent engine stops, and the instructions are not posted on the dashboard, so owners who weren’t meticulous about reading (or remembering) instructions from the owners’ manual may not know how to turn off the car while moving at very quick speeds.

When the Cause Map is complete to a sufficient level of detail, it’s time to explore some solutions. In this case, the permanent solutions (which will reduce the risk of these accidents most significantly) to be implemented by Toyota are to reconfigure the accelerator pedal, replace the floor mats, and install a brake override system which will allow the brakes to function even with the accelerator pedal engaged. However, designing and implementing these changes for more than 4 million cars will take some time, so owners of Toyotas require interim solutions. Interim solutions are those that do not sufficiently reduce the risk for long-term applicability but can be used as a stop-gap until permanent solutions are put in place. In this case, Toyota has asked owners to remove floor mats, and has put out guidance that drivers who are in an uncontrolled acceleration situation should shift the engine into neutral, which will disengage the engine and allow the brake to stop the car.

View the high level summary of the investigation by clicking “Download PDF” above.

Learn more about the recall at the NHTSA website.

Over the past three months, South Africa’s Airlink airline has had four incidents, ranging from embarrassing to fatal. Four similar incidents such as these start to point out a trend, which should be investigated to improve processes and increase safety. But how do we start the investigation?

In the Cause Mapping root cause analysis method, we begin by defining the problem. Here we can define four problems, which are the four incidents over the last three months. We can look at one incident at a time in a problem outline, the first step of the Cause Mapping process. We’ll start with the earliest incident first.

On September 24, 2009 at approximately 8 a.m. a Jetstream 41 crashed into a school yard in Durban Bluff just after take-off from Durban International Airport. This was a forced landing necessitated by the loss of an engine. The pilot was killed. There were also two serious injuries of the crew, and a minor injury of a person on the ground. There were no passengers on the plane, and the impact to Airlink’s schedule is unclear. However, the plane was lost.

We can capture this information more clearly and succinctly in an outline. For example, the above paragraph has more than 80 words. The outline, which records the same information, uses only 42 words in an easily understandable visual form. (The outline for all three incidents can be viewed by clicking on “Download PDF” above.)

The second incident: On November 18, 2009 at 1:30 p.m. a BAE Systems Jetstream 41 aborted take-off for East London and slid off the runway at Port Elizabeth airport. There were high velocity cross winds, and the pilot may have been unable to establish directional control. There were no injuries, no environmental impact and damages to the plane are unknown. However, new travel arrangements had to be made by the airline for all the passengers. The frequency of Airlink incidents is now two in eight weeks. (Over 80 words; the outline has 49 words.)

The third incident: On November 24, 2009 at approximately 8 a.m. a flight en route to Harare carrying a Prime Minister was forced to return to Johannesburg Airport after it experienced a technical fault. There were no injuries, but it caused a delay in the Prime Minister’s schedule. The damage to the airplane is unclear. The frequency of Airlink incidents is now three in two months. (Over 60 words; the outline has 33 words.)

The fourth incident: On December 7, 2009 at approximately 11 a.m. a Regional airline SA Airlink Embraer 135 commuter jet hydroplaned and overshot the runway while landing at George Airport during rainy weather. There were five injuries, including a sprained ankle. This incident has led to a poor public perception of the airline and increased supervision from the authorities. We do not have a dollar amount on the property damage. The frequency of Airlink incidents is now 4 in 10 weeks. (Over 70 words; the outline has 42 words.)

In addition to the increased brevity of the outline, it provides an easy visual comparison of the four incidents by showing them in a similar visual form. On one page, we can show the timeline, and outlines of the four incidents for easy comparison. This is especially useful for a briefing tool for busy managers.

In the early morning hours of Sunday, November 29th, after the Washington D.C. Metro shut down for the night, train 902 pulled into the West Falls Church station for cleaning. However, instead of stopping just behind the parked train already on the tracks, it rammed into it.

We can put this incident into a Cause Map, or a visual form of root cause analysis. A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. The first step in the Cause Mapping process is to outline the problem. After entering the “what, when and where” we frame the incident with respect to the Washington Transity Authority’s goals.

The operator, plus two other employees who were on the parked car cleaning, suffered minor injuries. This is an impact to the safety goal. The train cars, however, suffered extensive damage. Three of the cars will have to be replaced (at a cost of $3 million per car) and the extent of the damage to the other 9 cars involved is unclear. These are both impacts to the property goal. There may have been other goals that were impacted, but these are the main concerns.

West Falls Church-VT/UVA station, photographed by Ben Schumin on July 28, 2001

The second step of the Cause Mapping process is the Cause Map itself, or the analysis of the problem. To fill out the Cause Map, we begin with the goals that were impacted and ask why questions. The injuries and damage were caused by the parked train being struck by a moving train. The moving train was not stopped in time because the automatic train control system was not on (it’s not used in the railyard) and the speed suddenly increased, OR the operator wasn’t paying attention. (We don’t know yet, at this point of the investigation.)

Another train operator has come forward to say that this type of car suffers from power surges at low speeds (such as speeds used in the rail yard), which could have caused the speed to suddenly increase. We add this information to the map, and also add an evidence box showing where the information came from. This can be invaluable when sorting through a lot of information.

Although it is known that the operator had surpassed a ten-hour shift, it’s not known if fatigue or other causes of inattentiveness were involved. A union representative has asserted that the training program was unsatisfactory, which may have also played a part. As the National Transportation Safety Board (NTSB) and the Transit Authority continues their investigation, more detail can be added to this Cause Map as the analysis. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

At approximately 11:00 p.m. on October 12th, 2009, the two 500,000 lb strength towlines connecting La Prinsesa barge to its tug broke free.  The tug was unable to recapture the ship, and it drifted for about seven hours in heavy seas caused by a wind-driven rain storm before grounding at Sandbridge Beach in Virginia, just shy of the Sandbridge pier.

 So far the 84 hazardous material (HAZMAT) loads the barge was carrying appear to be intact.   There were no injuries, as the barge was unmanned.  Damage to the ship is not known at this time.   However, the incident had the potential to cause injuries, a HAZMAT spill that could have led to an evacuation, and far more damage to the ship and the beach.  The incident did lead to the loss of the towlines, which are valued at approximately $70,000 and a delay in the barge’s arrival.

 It’s unclear what caused the towlines to break free.  Initial solutions are to clear the area and ballast the tug to attempt to keep it from drifting.  On November 17, the barge began being towed to open waters where the cargo can be off-loaded safely. However, long-term solutions that would prevent another incident of this type will only be determined after the causes of the issue are determined. 

 Click on “Download PDF” to view a PDF showing the root cause analysis investigation based on what is known  so far.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  Even more detail can be added to the Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the magnitude of the impacts (or potential impacts).

The first step of the Cause Mapping strategy of root cause analysis is to define the problem with respect to the organization’s goals.  In order to do this, you need to know what an organization’s goals are.  While we provide Cause Mapping root cause analysis templates that will give you an idea of where to start, your organization may wish to personalize their investigations so that they correspond to your particular goals. 

To define your organization’s goals, try to imagine a perfect day for your organization.  No matter what industry you’re in, that perfect day doesn’t include anyone getting hurt or killed.  This is the safety goal.  However, if your organization regularly is responsible for the health and welfare of people other than your employees, you may wish to have more than one category of safety.  For example, a hospital may have both “patient safety” and “employee safety” goals.  A public school may have “student safety” and “employee safety” goals. 

Another goal generally common to all industries is the goal of not impacting the environment.   However, some industries have a base level of environmental impact, so their goal might be to not surpass that level rather than having no impact.  Environmental impacts usually result from leaks or spills of any material other than water, but may also result from improper storage or disposal of hazardous material.

Some organizations may have as a goal to meet regulatory requirements.  If an organization has an OSHA (Occupational Safety and Health Administration) reportable injury, this is an impact to the “Regulatory Compliance” goal.  Organizations may also have a “Compliance” goal if they are subject to another governing body, such as a trade group or an external accreditation.

Organizations usually exist to provide either products, services, or both.  If an organization provides products, a goal of that organization may be to get a set amount of products produced and delivered on a certain schedule.  We call this the “Production/Schedule” goal.  An organization that provides services wants to ensure that its customers are satisfied with the services they provide.  This is the “customer service” goal.  Many organizations will use both goals to define a problem.

Another area of concern for almost all organizations is cost.  An incident that requires additional labor, rework, or lost product results in unplanned costs for the organization.  We call this goal the “material and labor goal”.  If an incident results in many costs, it’s possible to itemize them within the problem outline.  Quantifying all the costs associated with an incident can help prioritize which incidents require the most immediate attention.  It also provides a bound for the cost of solutions – installing a $100,000 machine to solve an infrequent $20,000 problem doesn’t make sense.  (Of course, for incidents that involve impacts that can’t be easily quantified – human safety, regulatory requirements, customer service, etc.  – these impacts must be considered above and beyond the “cost” of the incident.)

Once you’ve determined all of the goals that are meaningful to your organization, you’re ready to make an outline for the first step of the Cause Mapping method of root cause analysis – define the problem.  But what order do you put the goals in?  Generally, the goals go in order from most to least important.  The safety goal is almost always at the top.  Your organization’s mission statement is an excellent resource to determine the order of the goals.  Ideally, they’ll follow along with your mission statement, with any goals not specifically called out (such as the “material and labor” goal) listed below.  It’s also possible to use a different order so that the biggest impacts from an incident are listed at the top.  However, your organization may prefer to always use the same order for consistency. 

If an incident resulted in no impact to one of your organization’s goals, don’t delete the goal from the problem outline.  Instead, write “N/A” next to the goal.  That way, it’s clear that the goal was considered but it was determined that there was no impact.  Deleting the goal may lead others to believe that it’s no longer a goal of the organization!

Check out our examples to see a problem definition in action!

ThinkReliability has specialists who can solve all types of problems. We investigate errors, defects, failures, losses, outages and incidents in a wide variety of industries.  Contact us for investigation services and root cause analysis training.

In a previous blog, I wrote about the impressively quick repairs to the San Francisco-Oakland Bay Bridge.  These repairs allowed the heavily-traveled bridge to reopen only an hour and a half late from scheduled repairs, despite unexpectedly finding a cracked eyebar during that time.

However, during evening rush hour on October 27, less than 2 months after the eyebar repair had been completed, two metal rods and a 5,000 pound metal beam fell onto the roadway.  The items that fell were part of the previous repair, which was supposed to have lasted until the new bridge opened in 2013. Although only one motorist was injured, other injuries or even fatalities were possible, and the damage to the bridge necessitated repairs and closing the transportation route for 280,000 cars a day for more than 5 days.

The “cause” given for the failure of one of the rods (which snapped, leading to the falling of the other rod and the beam) was fatigue caused by high (over 30 mile per hour) winds.  However, an adequate repair would have been able to withstand less than 2 months of traffic and 30 mile per hour winds, so the rod failure must have been caused by the combination of the high winds and an inadequate repair. 

Given the speed with which the repair was completed (see our previous blog), it’s possible that the repair job was rushed.  Additionally, the Federal Highway Administration did not inspect the bridge after the repairs were completed, instead relying on state inspection reports.  Had another agency inspected the repairs, it’s possible the problems with the repair would have been noticed and fixed before the bridge was re-opened. 

A summary of the investigation to date can be found on the downloadable PDF.  (To open, click on “Download PDF” above.)  The investigation includes a timeline, which can aid in the understanding of this issue, the problem outline, and the Cause Map (visual root cause analysis).  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  As with any investigation, as more information becomes known, more detail can be added to the Cause Map.

On October 21, 2009, Northwest Airlines Flight 188 left San Diego and overshot its intended destination, Minneapolis-St. Paul by about 150 miles. Luckily, the incident resulted in a safe landing at the intended destination, but the circumstances surrounding the flight remain vague and unsettling.

One of the strangest facts that have come out is that the plane lost contact with air-traffic controllers for one hour and 18 minutes.  In the post 9/11 aviation environment, controllers are very sensitive to planes that quit responding to communications.  The Federal Aviation Administration had contacted military authorities about the possibility of terrorism.  Fighter jets were ready to respond and prepared to intercept the plane if necessary.

So what happened?  How did the pilots overshoot the airport by such a significant amount without realizing their mistake?

Initial reports were that the pilots stated that they were in a heated discussion and simply lost situational awareness, but many aviation experts have stated it is unlikely that pilots would miss repeated hails for over an hour because of an argument.  Other reports have speculated that maybe both pilots fell asleep. 

The most recent information to come out is that the pilots were using their laptops during the time they failed to respond to hails.  The pilots stated that they both were working on laptops and that they were discussing monthly flight crew scheduling. 

Details concerning the overshoot are still being investigated, but an initial root cause analysis can be started to help document the investigation as it progresses.  This is what an Outline could look like at this stage:

A preliminary Cause Map can be started at this stage of an investigation.  As more information is known a detailed Cause Map can be built to document all the relent information.

More data should be available soon.  The Cockpit Voice Recorder and the Flight Data Recorder have both been sent to the National Transportation Safety Board for analysis and interviews of all involved parties continue.

On October 28, it was announced that the FAA has revoked the licenses of the two pilots involved because they violated several federal regulations, including fail to comply with air traffic control instructions and operating carelessly and recklessly. There are no currently specific federal rules banning the use of laptops after the flight reaches 10,000 feet at this time.

The mission of the Genesis spacecraft was to collect the first samples of the solar wind and return the samples to earth to be analyzed. The goal was to provide fundamental data to help scientists determine the composition of the sun and learn more about the formation of our solar system.

Unfortunately, during descent on September 8, 2004, the Genesis crashed into the earth at high velocity. Its descent was only slowed by air resistance and the collection capsule was damaged on impact.

What happened? What went wrong with the re-entry?

A root cause analysis can be performed to evaluate this incident. The investigation can be documented by building a Cause Map that collects all the information associated with the incident in a visual format that is easy to follow.

In this case, the main goal we’ll consider is the production goal. The production goal was impacted because the collection capsule was damaged, which had the potential to destroy all the physical data collected during the three year mission.

The investigation can proceed by asking “why” questions and adding the causes to the Cause Map. In this scenario, the collection capsule was damaged because it impacted the earth at high velocity. This occurred because the parachute that was intended to slow the descent to allow for a midair recovery by helicopter failed to deploy.

Post-accident investigation determined that the parachute was never triggered to deploy because gravity switches were installed backwards. The backward installation occurred for several reasons: the design was flawed, the design review process didn’t detect the error and the testing performed didn’t detect the error.

Luckily, the impact to the production goal has been less significant than it might have been in this case. The collection capsule was cushioned somewhat by the soft ground and while desert dirt entered the capsule, liquid water did not. The solar wind particles were embedded in the collection materials and the contaminating dirt was able to be removed for the most part. NASA has been able to retrieve significant amounts of data from the mission.

NASA’s Mishap Report can be downloaded for free for additional information on the incident.

A one page PDF showing a high level Cause Map of the incident can be downloaded by clicking on the button above.

On February 7, 2008, an explosion at the sugar refinery in Port Wentworth, Georgia resulted in the deaths of 14 workers.  It also injured 36 and caused significant damage to the refinery.  Immediately following the incident, we began a very simple root cause analysis, leaving the more detailed analysis for when the Chemical Safety Board (CSB) report was released and more detailed information could be found.  The CSB final draft report was recently issued and with the information it contains, we can add more detail to our Cause Map.

We can begin our analysis by beginning with a goal that was impacted and using the “5-whys” approach.  The 14 deaths and 36 injuries were caused by the propagation of secondary explosions and fire.  The secondary explosions and fires were caused by a primary explosion, which was caused by an explosive concentration of sugar dust, which was caused by inadequate housekeeping.

From here we can add more detail to our map.  For example, difficulty evacuating the plant was also a cause of the deaths and injuries.  The difficulty was caused by having no evacuation drills, and using cell phones and radios to communicate instead of an intercom or emergency alert system.    

In order for the explosions to propagate, they needed additional fuel.  This was found in the accumulated sugar dust in open areas of the plant, due to inadequate housekeeping, and a dust removal system that was not functioning properly and had ducts filled with sugar dust.

Since “inadequate housekeeping” has now come up twice on our map, let’s expand on that a little.  There was a lack of awareness of the hazards of sugar dust.  The facility risk assessment did not address these hazards, there was very little training on dust hazards, and there was little regulatory oversight which might have created more awareness or cleanliness requirements.  OSHA’s hazardous dust safety standards were limited to grain, and the State of Georgia had no regulations addressing dust.  (Both of these issues are in the process of being fixed.)

Although the sugar dust accumulated due to lack of housekeeping, it required more to reach explosive levels.  The containment was provided by steel panels installed around the conveyor which were designed to protect the sugar from contamination.   The dust also required an ignition source.  Due to the extensive damage, the CSB was not able to pinpoint the ignition source. 

The CSB identified several solutions that would mitigate the risk of future incidents.  Some of these solutions are for Imperial Sugar to implement at this site, such as holding evacuation drills, increasing training on dust hazards, improving the housekeeping program, and installing (and using) an intercom system.  As discussed above, OSHA and the State of Georgia are implementing standards and regulations to decrease the chances of a dust explosion in their jurisdictions.  Also, the CSB has recommended that the company who performed the risk assessment at Imperial Sugar consider dust hazards as a risk.  

Click on “Download PDF” above to see all the information discussed above in a visual form.

The Defense Advanced Research Projects Agency (known as DARPA) issued a request for ideas on how to clean up orbital debris, commonly known as space junk, last week. The term space junk refers to all the objects currently in orbit around earth that no longer serve a useful purpose.

 Why would DARPA want to put effort into removing space junk?  Why is it a problem?

 A root cause analysis of this issue can be performed.  The first step is to identify the problem.  Then the investigation can be documented as a Cause Map and the causes contributing to the space junk problem should be investigated. In this case, the problem is that space junk poses a threat to unmanned and manned spacecraft, including satellites. 

 Space junk comes from a variety of sources (which will be discussed later) and is a wide variety of sizes. Impacts with large debris (greater than 1 kilogram) can destroy spacecraft at orbital velocities.  The only protection currently available is to move the spacecraft out of the path of space junk. Impacts with tiny debris cause erosion damage and can substantially shorten the life span of spacecraft.  Solar panels and windows are especially vulnerable to this type of damage. 

 Destroyed spacecraft then become part of the problem as long as they remain in orbit as defunct space junk themselves.

 In addition to nonfunctioning, dead spacecraft, some of the causes of space junk are boosters from past spacecraft launches, lost equipment, and debris from weapons testing.  These causes should all be added to the cause map.

 The problems associated space junk continue to increase and with more and more debris is created in earth’s orbit.

 The largest space debris incident in history occurred in 2007 after China performed an anti satellite missile test and intentionally blew up a defunct satellite.  This test also targeted a satellite in the most heavily populated area of earth’s orbit. 

Currently, the Space Surveillance Network tracks more than 20,000 objects in orbit.  And this number only includes those large enough to track.  There are estimated to be thousands of objects too small to track currently in orbit.

 Hopefully DARPA is able to find an effective solution to mitigate the problem and reduce the risk posed by space junk. 

 Click on the “Download PDF” bottom above to view an intermediate level Cause Map of this issue.

A recent report by a White House panel of independent space experts says NASA’s current goal to return to the moon isn’t feasible with the current budget. The panel estimates that NASA would need about $3 billion extra a year beyond the current budget to continue with human space flight.

The budget shortfall is obviously a problem that may prevent NASA from meeting their overall organizational goals.  A root cause analysis built as a Cause Map can be created to understand how this issue developed.

In this case, the production goal is impacted because NASA is likely to be unable to meet the stated goal of a moon mission by 2010.  This is caused by the high cost of a moon mission, other budget considerations (such as the cost of possibly extending the moon mission and the International Space Station) and the limited NASA budget.  The causes of each of these can then be explored.

NASA has been working toward a return to the moon because five years ago then-President George W. Bush stated that NASA should work to return astronauts to the moon, with a proposed date of 2020.  NASA has already spent $7.7 billion working toward this goal, including the design and the construction of new rockets.

Part of the plan to pay for this venture was to retire the space shuttle in 2010 and deorbit the International Space Station in 2015, but the panel also recommended revaluating these deadlines, which would add additional budget pressure. 

The panel found that extending the life of the space station beyond 2015 would allow a better return on the billions of dollars invested into it.  The panel also felt the space shuttle should be evaluated for possible life extension as well in order to continue to service the space station, since there is no viable alternative that will be developed in the necessary time frame. 

NASA budget continues to be limited as national budget constraints increase.  In order to raise funds, the panel also recommended including other countries and private-for-profit firms in addition to increasing NASA budget.

This problem has no easy, clear solution.  Only time will tell how President Obama will choose to respond to these findings and if human space flight will continue to be a goal for NASA.

San Francisco’s 73-year old Bay Bridge partially collapsed during the Loma Prieta earthquake of  1989.  As a result, a seismic upgrade project was planned.  The bridge closed Thursday night, September 3rd, 2009, as part of the upgrade project.  Authorities conducted a thorough inspection of the bridge while it was closed.  During this inspection, an eyebar was found to be cracked about halfway through.  

Construction crews worked around the clock to get the bridge repaired and inspected before morning rush hour.  Was it worth the rush?  Ask the 260,000 commuters who normally cross the bridge every day.   However, local transit officials did not rely on the bridge opening on time.  Instead, they made other arrangements, including adding high-speed catamarans to the ferry line-up. 

This is an excellent demonstration of the use of “Plan B”, or implementing multiple solutions for issues with great impacts to the goals.  In this case, the repairs were necessitated by the possible loss of the bridge – certainly an impact to the goals of a transit authority.  The accelerated repair schedule and additional transit options were necessitated by the potential loss of the bridge as a transportation route during high traffic-volume times, resulting in an impact to the customer service goal.

In recent years, the cost of attending a college in the US has risen about three times faster than inflation and the average student loan amounts have increased accordingly.  Combine this with the highest unemployment rates of college graduates since 1979 (4.8% in May, up from 2.1% at the start of the recession) and lower starting salaries during recessions, and there are many recent graduations struggling to make their loan payments.

As with any problem, it is possible to perform a root cause analysis of the issue. To begin let’s assume the production goal of an individual considering college is to earn a comfortable living and the potential impact to this goal will be difficultly making loan payments.

The causes of this potential problem repaying loans could be unemployment after graduation, lower starting salaries for new hires during a recession and large loan payments.  The causes of each of these factors can then be explored.  Click on the Download PDF graphic above to view an intermediate level Cause Map with more causes added.

A recent USA Today article entitled “In a Recession, Is College Worth It? Fear of Debt Changes Plans” discussed how many students are rethinking their college plans.  Enrollment at community college is soaring and many students are choosing a less expensive option and skipping the big name private institutions.

This makes sense when considering the potential difficulty repaying college loans because the only cause that the student has direct control over is the size of the loan payments. 

The bottom line is that each individual needs to think through their particular situation, consider how much the college costs and how much the starting salary for their particular degree is projected to be.  There are very real dangers in amassing large student loans without calculating the monthly payments and ensuring that they are within a realistic budget.

The reality is that some universities cost more and there is no guarantee that attending a more expensive college will result in a higher salary.  It may well be a smart decision to choose a less expensive option when selecting a college.

If you’re interested in reading an analysis of the 2009 Financial Mess, please click here.

The partial meltdown of a core at the nuclear power plant at Three Mile Island is one of the most well known engineering disasters in US history.  Luckily, no one was injured and there was no significant environmental impact, but the potential for major issues was very real.  Three Mile Island also had a huge impact on the nuclear industry and required a major clean up effort.

Performing a root cause analysis of historical incidents is useful because there are a number of lessons learned that can often be applied across a variety of industries. 

As is true with any complex system, there were many causes that contributed to the Three Mile Island incident.  At the most simplified level, cooling water flow was stopped to the primary system (the nuclear portion).  The primary system then started to heat up, increasing the pressure to the point that a relief valve lifted.  The relief valve then failed to reseat and a large volume of coolant was lost.  The core eventually overheated because it was uncovered due to the loss of coolant. 

Another factor that contributed significantly to the Three Mile Island incident was operator action during the casualty, which occurred over several shifts.  Had operators been able to understand the status of the plant in a timelier manner, the plant could have been put into a safe condition.  

At first glance, it’s easy to stop at this point and use a term like “operator error”, but a thorough analysis requires more digging. Even if the technology being considered is radically different than a nuclear power plant, there are many lessons that can be learned from studying how the control room design impacted the operator actions during the incident.   

The design of the control room significantly contributed to the operators’ inability to identify plant conditions.  The control room was huge with hundred of instruments to monitor, some of which were on the back of the control panels and couldn’t be viewed in the normal watch standing locations.  Dozens of alarms, both audible and flashing lights, went off in a very short period of time without any obvious priority.  The alarms continued throughout the casualty and the sheer volume of information was nearly impossible to interpret accurately.  

Many industries continue to benefit from the lessons learned from the design of the control room. 

For more detailed information on the Three Mile Island accident, please see the NRC’s Three Mile Island fact sheet.

Basing Contingency Plans on the Impacts to your Organization’s Goals

An excellent discussion resulted as part of our free Webinar series last week. An attendee asked the question  “What if there’s a cause you can’t control, like the weather?” So another question was raised; “How do you prepare for those sorts of things?”

You can prepare for potential problems that may arise by using a Cause Map, just like you would after an actual problem occurred. We call the Cause Map of things that COULD happen a “proactive” Cause Map, while a Cause Map of something that DID happen is a “reactive” Cause Map. Typically you will see reactive Cause Maps, but a proactive analysis can be extremely useful for contingency planning, as well as to develop problem-solving skills.

To create a proactive (or COULD) Cause Map, follow the same steps normally used in a root cause investigation, trying to imagine the possibilities for impacts to the organization’s goals.  Then create the Cause Map and determine possible solutions (action items). The “cost” of the impacts to the goals will depend which solutions are reasonable to implement.

As an example, let’s look at a power outage from the perspective of a hospital. (View The Joint Commission’s Sentinel Event Alert on power outage.)  A power outage could lead to the deaths of patients, resulting in an impact to the safety goal. It could lead to the loss of life-saving equipment, resulting in an impact to the customer service goal. It could cause the facility to not be able to admit new patients, resulting in an impact to the production goal.  And, it can result in material and labor costs resulting from the transfer of patients to another facility.

Beginning with these impacts to the goals, we can create a Cause Map. (The Outline and Cause Map are shown on the downloadable PDF.) All the impacts to the goals lead back to a loss of electrical power, caused by both a power outage AND a lack of back-up electricity source.

When determining solutions, there are a few that come to mind, including transferring patients to another healthcare facility (which itself becomes an impact to the goals) and installing battery backups in equipment.  However, because of the severe impacts to the goals, a hospital will likely decide that the whole problem can be solved by installing an emergency generator.  Problem solved.  However, is installing an emergency generator always the right contingency plan for a power outage?

Let’s look at the same situation from the perspective of an office building. A power outage could cause some employees to get injured as they’re exiting the building, resulting in an impact to the safety goals. It will result in the loss of the business function of the office, resulting in an impact to the customer service and production goals. It may also result in paying employees for a non-work day, which is an impact to the labor goal.

The Cause Map looks similar to the hospital power outage Cause Map in that all the impacts lead back to a loss of electrical power, caused by a power outage and lack of back-up electricity source. So, we could put in an emergency generator just like the hospital did and have our problem solved. But the effort and capital required to install an emergency generator based on the lesser impacts to the goals is probably not worth it. Instead, some of the less expensive and consuming solutions can be implemented, such as installing emergency lights and setting up remote work stations for employees.

View the Outlines and Cause Maps for both the hospital and office building power outages by clicking “Download PDF” above.

On August 8, 2009, a small airplane clipped the wing of a sightseeing helicopter and both aircraft crashed into the Hudson River, killing all nine people.  The crowded corridor above the Hudson River was also the site of the successful crash landing of U.S. Airways Flight 1549 in January, 2009.  The evidence from the crash is still being recovered from the accident site, so the investigation is ongoing.  However, just because we don’t have all the causes doesn’t mean we can’t start our root cause analysis.

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  To begin, we define the problem in an outline.  So far, we know the date and approximate time of the collision.  (We may be able to refine the time of the accident as more information is released.)  We know the location of the collision based on eyewitness accounts and the discovery of wreckage.  We also know the type of plane and helicopter involved, and what they were doing (the plane was in transit to Ocean City; the helicopter was on a sightseeing tour).

Next we define the problem with respect to the impact to the goals.  The safety goal was impacted because nine people were killed.  Both the airplane and helicopter were lost (or at the very least, severely damaged), which is an impact to the material goal.   Lastly, if we have the information, we can record the frequency of this type of incidents.  The last helicopter/airplane collision in the New York City area was in 1983.

Once we’ve completed the outline, we can move on to the Cause Map.  We begin with the impacts to the goals and fill in the Cause Map by asking “Why” questions.  Both goals were impacted because the plane and helicopter crashed into the water.  We continue to ask “Why” questions.  Both aircraft fell into the water because the plane clipped the helicopter’s wing.  The pilot clipped the helicopter’s wing because the plane and the helicopter were in the same airspace.  And, it’s surmised that the pilot could not see the helicopter.  (We don’t have any solid evidence supporting this yet, so we’ll leave a question mark.) 

The plane and the helicopter were in the same airspace because the area is crowded with sightseeing helicopters and small planes which are prohibited from flying above buildings or over 1,100 feet.  Around New York City, that pretty much leaves the river.  Pilots who are flying below 1,100 feet are free to choose their own route, and are not under the control of air traffic controllers.  Instead, they use the “see and avoid” method.

Unfortunately that method isn’t successful when a pilot can’t see an incoming helicopter.  Although small planes are not controlled by air traffic controllers, they are in communication with them.  However, the pilot of the plane had never contacted the Newark controllers.  The helicopter was ascending at the time of the crash, so it’s likely that it came from below the plane (where the pilot would be unable to see it).  The helicopter may have been unaware of the plane because it’s not required (though it is recommended) for pilots to announce their position.   

As the NTSB investigation continues, more detail can be added to this Cause Map… As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

In honor of the Discovery Channel’s “Shark Week”, we’ll use the problem of shark species at risk of extinction as an root cause analysis example. We’ll begin by building a Cause Map, which is a visual method of performing a root cause analysis. 

We begin a root cause analysis with an impact to the goal.  Shark species being at risk for extinction is an impact to the environmental goals.  While I didn’t add this kind of detail, evidence has shown that a decrease in the number of sharks results in problems for the rest of the food chain. 

We fill out the Cause Map by asking “Why” questions.  Shark species are at a risk of extinction because the death rates of sharks are higher than the birth rates.   Sharks have low reproductive rates (they mature slowly, have long gestational periods, and birth few young), and increasing death rates.  The increasing death rate is due to over fishing (fishing without regard to population), injured sharks being left to die, and loss of habitat, caused by pollution.  The combination of sharks being fished for sport, food, or products (which are rising in value; sharks are thought to cure cancer) and the lack of effective regulation has led to over fishing.  Many sharks are injured, either as “bycatch” meaning sharks are brought up in fishing nets while fishing for something else, or by a practice known as “finning”, where a shark’s fin is cut off.  (Shark fin soup is very popular.) In both cases, sharks are typically thrown back into the water injured and left to die.   Many countries have a ban on finning, but the ban is not always effectively enforced.

Many countries around the world are trying to protect sharks.  Some of the solutions they have implemented are to create shark fishing quotas, increase enforcement of fishing quotas and finning bans,  decrease the market for shark products and shark fin soup, and limiting any fishing in known shark habitats.  Solutions can be shown on the Cause Map, directly above the cause they control.  Once solutions have been selected for implementation, as these have been, they are listed in the Action Items list.  (To see the Cause Map and Action Items list, click on “Download PDF” above.)

On August 1, 2007, the I-35 bridge over the Mississippi River in Minneapolis, Minnesota collapsed during evening rush hour, killing 13 and injuring at least 145.  During the National Transportation Safety Board’s investigation, it was discovered that the gusset plates (the riveted metal plate that joins several structural members) were designed with inadequate load capacity.  At the time of the bridge collapse, the load on the gusset plate that failed was higher than usual, due to construction materials and equipment concentrated on the deck over the location of the gusset plate and rush hour traffic slowed by the construction.  In addition to these weights, the dead load (weight of the bridge structure) had increased by more than four million pounds due to improvements made to the bridge since it opened in 1967.

Bridges are inspected regularly, and go through a design review process . . . so how did the gusset plate design error get missed?    The design for the gusset plates was apparently supposed to be a preliminary design, which neglected shear stress.  Although the firm that designed the bridge required a review of all calculations before the final design, the procedure did not ensure that all calculations were rechecked, so the gusset plate calculations that ignored shear stress were overlooked.

The design was reviewed by the government, but their design review did not apply to gusset plates.  The gusset plate capacity was not calculated as part of the load rating calculations.   Gusset plates were not listed as a separate element to be inspected during a bridge inspection.  And, the training for bridge inspectors continued very little information about gusset plates.  Why?  Because it was widely assumed that gusset plates are stronger than the members they join and so can be neglected in calculations in order to simplify the analysis.  In most cases, this assumption is true.  However, since the gusset plates were designed incorrectly, and so were much weaker than typical, allowing this assumption to go unchecked, on several different occasions, proved disastrous. 

Thanks to this tragedy, it’s unlikely the same problem will happen again.  Structural design and bridge inspection training material is being rewritten to include the lessons learned from this bridge collapse, and inspections are now considering the strength of gusset plates as part of their evaluation.  Assumptions are made all the time, but these assumptions need to be verified. 

Click on download PDF to see the NTSB’s root cause analysis investigation results visually displayed in a Cause  Map.  A  Cause Map can capture all of the causes from an investigation in a simple, intuitive format that fits on one page.

Click here for another example of a case where a minor item caused some major issues.

During the overnight shift on November 5, 2005, two workers at a refinery in Delaware City, Delaware died from asphyxiation.  Both workers had entered a confined space that was filled with nitrogen.  We will use information from the Chemical Safety Board’s root cause analysis investigation to create a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The first step in our analysis is to define the problem by filling out the outline.  The outline contains the what, when, where and impact to the goals.  The “what” is the problem; in this case two workers were asphyxiated.  The when is the overnight shift of November 5, 2005, and the where is the hydrocracker reactor of a Delaware City refinery.  The workers were apparently attempting to retrieve dropped tape.

Because two workers were killed, there was an impact to the safety goal.  There may have been impacts to other goals as well, but the loss of life makes other impacts less significant. 

Once the outline is completed, we use the impacted goal to begin the Cause Map.  We begin with the impacted goal and ask ‘why’ questions.  A good way to begin is using the “5-why” technique.  Begin with the impacted goal and ask “why” 5 times.  This will start the Cause Map.  For this incidence: the safety goal was impacted. Why? Because two workers died.  Why? Because they were asphyxiated.  Why? Because they entered a confined space.  Why?  They were attempting to retrieve lost tape.  Why?  Because the tape was left in the reactor.  

From the “5-why” Cause Map we can add more detail to the root cause analysis.  Additional causes can be added before, after and between the causes on the 5-why map.  For example, the workers were asphyxiated because they entered the confined space AND the space was filled with nitrogen.  The space being filled with nitrogen is added as an additional cause of asphyxiation, and is joined with “AND” because both causes had to be present for the asphyxiation to occur.

Even more detail can be added to this Cause Map as the root cause analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals. The outline, “5-why” Cause Map and detailed Cause Map can be seen by clicking “Download PDF” above.

With swine flu in the news lately, ‘epidemic’ has been on many minds. However, there is still much that isn’t understood about swine flu. There are other epidemics that we understand much better, such as yellow fever.  Yellow fever has been causing epidemics for a long, long time.

But how does it happen?  We can do a root cause analysis of a yellow fever epidemic to find out.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

Since we are not looking at a specific event, but rather a general situation we will start with just one impacted goal. A yellow fever epidemic can result in the deaths of thousands of people, which we will consider an impact to the safety goal. 

We begin the root cause analysis with this impacted goal and ask “why” questions.  Several thousand people may die because there is no cure for yellow fever, it has a high mortality rate, and several thousand people get infected.  The people get infected because they’re not vaccinated, and they are bitten by an infected mosquito in the epidemic zone.  (The endemic zone is areas of Africa and South America where a low level of yellow fever is always present.  The epidemic zone is an area outside the endemic zone to where yellow fever is spread and an epidemic occurs.)

People are not vaccinated because they don’t have access to the vaccine: either it costs too much, or the area is to isolated to receive vaccine. In order for someone to get bit by an infected mosquito in the epidemic zone, the mosquito must be infected, and the person must have been exposed to a mosquito in the epidemic zone.  In order for a person to be exposed to a mosquito, the mosquito must have access to a person, and mosquitoes must exist, meaning they are able to breed, meaning breeding pools exist.   

A mosquito gets infected by biting a person infected with yellow fever. For yellow fever to spread from the endemic zone to the epidemic zone, this means a person was infected with yellow fever in the endemic zone,
and traveled to the epidemic zone.  The person gets infected with yellow fever by being bitten by a mosquito infected with yellow fever (in the endemic zone) without being vaccinated.  The person gets bitten by an infected mosquito because they are exposed to mosquitoes (for the same reasons listed above) that are infected, usually by biting monkeys who have been infected by yellow fever.

If you had trouble following all of that, you can see why a process map would be helpful.  On the downloadable PDF, both the Cause Map and process map are shown.

On the evening of July 4th, after watching fireworks, revelers at a park in Merrillville, Indiana headed back to their cars over a pedestrian bridge.  The bridge became overloaded and collapsed when two suspension cables snapped.  Somewhere between 50 and 120 people fell into the lake.  Although 25 were treated for injuries, nobody was killed, thanks to quick action by nearby lifeguards, police officers, firefighters and other rescuers who formed a human chain to help get everyone safely out of the water.  We’ll use this as an root cause analysis example.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.First we complete the outline.  The problem is a bridge collapse.  It happened at 10:00 p.m. on the 4th of July, while there were large numbers of people on the bridge.  It was a pedestrian bridge in Merrillville, IN, and people were crossing it to return home after a party.

Once we have defined the problem we list the impacts to the goals.  People being injured is an impact to the safety goal, as is the potential for drowning.  People fell into the lake, which was an impact to the customer service goal.  Additionally, the loss of the bridge is an impact to the material and labor goal.

We begin our Cause Map by listing the impacted goals and asking “why” questions to fill out the Cause Map to the right.  Begin with 5 “why” questions to start the Cause Map.  This is known as the “5-whys” technique.  For example, the safety goal was impacted.  Why? The safety goal was impacted because people were injured.  Why? People were injured because they fell into the lake.  Why?  They fell into the lake because the bridge collapsed. Why?  The bridge collapsed because the suspension cables broke.  Why? The cables broke because the weight on the bridge exceeded the bridge capacity.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  For this investigation, we can add some more detail to the “5-why” Cause Map to help our investigation.  For example, pedestrians fell into the lake because the bridge collapsed AND because pedestrians were on the bridge, returning to their cars after the 4th of July party.  

There may have been additional stress on the bridge due to pedestrians jumping up and down, as reported by witnesses.  Additionally, we can add more detail after the “weight exceeded capacity” on the bridge.  The bridge was built to hold 40 people, but “at least twice that” were on the bridge when it collapsed.  So many people were on the bridge because they were returning to their cars (as discussed above), and because of ineffective crowd control.  There were too many people on the bridge despite officers stationed on either side.  Why was the crowd control ineffective?  It’s not known at this point, but we’ll put a question mark here.  The next step of the investigation will be to replace that question mark with reasons for the ineffective crowd control.  Once we’ve done that, we can come up with solutions that will keep an event like this one from occurring in the future.

On the evening of June 29, a train carrying liquefied natural gas derailed and exploded in the town of Viareggio, in western Italy.  Search and rescue operations are still ongoing, and the cause for the derailment is not yet known.  Although that means we are lacking some information, we can still begin our root cause analysis investigation, in the form of a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. 

The benefit to beginning a root cause analysis investigation before all the information is known is to provide a framework for the investigation to build on.  People find it much easier to comment on a partially finished Cause Map than to piece together the investigation from scratch. 

A root cause analysis template is available for download from the Think Reliability web page to assistant with the investigation.  The first step is to fill out the outline.  Don’t leave any blanks in the outline; if you don’t know something, put a question mark.  The first line is the ‘what’ or the problem.  Rather than spending time debating what ‘the problem’ is, we can put a number of things.  For example, the problem here could be defined as a gas leak, an explosion, and a train derailment.  We put all these things on the problem line.  The rest of the information is known, though we may add more detail later, except for differences.  Differences can be key to an investigation.  For example, if you have a process that works for 30 straight sunny days, then fails the day it rains, it is worth looking into the impact of the rain on the process.  Here, no differences are immediately coming to mind, so we’ll put a question mark in this blank.

Once we’ve defined the problem, we can define the problem with respect to the impact to the goals.  We don’t know how many people, overall, were killed or injured, but we can just put “at least” to show that the numbers aren’t exact.  We know that the environmental goal was impacted, because of the gas leak, the community goal was impacted because of the required evacuation, and the material/labor goal was impacted because of the collapsed houses, and the damage to the train.

Now we begin the analysis.  We begin with the impacted goals and ask “why” questions, moving to the right.  When we can’t answer the “why” question, we can use a question mark, or put some possibilities (theories) that have been presented.  For example, we’re not yet sure why the train derailed.  Some of the possibilities that have been presented are damage to the tracks, a problem with the braking system, or malfunctioning wagon locks.  The Cause Map (so far) is shown in the downloadable PDF (to download, click “Download PDF” above.)  As you can see, there is a lot of information present, even though we don’t know all of what happened yet.

As more information is available, we can update the Cause Map.  As with any root cause analysis, the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

Yesterday I wrote a post about the Metro train collision in Washington, D.C. More information on the accident has been released today, so we can use this information to update the (visual Cause Map (visual root cause analysis). (The PDF, which can be opened by clicking on “Download PDF” shows these changes.)First, the injury count has increased to at least 80, so we update the outline. Also, we have discovered that the lead car in the train was a “B” car. (Metro cars are put in pairs, with the lead car ordinarily being an “A” car.) While this might be a cause of the accident, we don’t yet have enough information to link it on our Cause Map. Instead, we can add it to the outline as a “difference”.

Additionally, more information has come to light about the lack of retrofitting or replacement of the old cars, which were not considered crashworthy by NTSB. The reason given for not retrofitting or replacing the cars is because it would be too expensive, as Metro is without dedicated funds (the only major transit system in the country to operate this way).

Investigators have discovered that the operator had successfully engaged the emergency brake. Our previous information, obtained from the unofficial testimony of passengers on the train, was that there was no attempt to stop or slow the train. Now that new evidence contradicts the old evidence, we can remove “No attempt to stop/slow train” as a cause. Instead, the cause for “Train rear-ended stopped train” is “Striking train did not stop”.

One of the causes for “striking train did not stop” is that the emergency brake was ineffective. It was ineffective because it was pulled too late, because the operator was not aware of the stopped train, or because the braking system was not functioning, or both. The causes for “operator unaware of stopped train” have not changed (yet) since our previous version. However, it has been released that the crash happened on a curve, which is a possible cause for the operator being unable to see the other train. Right now there is no evidence to show that the operator was otherwise distracted.

As far as “brake system not functioning”, we now have evidence that the first two cars of the striking train were two months overdue for brake maintenance. We’ll add that as a cause.

We have moved ineffective mechanical override as a cause for the train not stopping. This sytem should have automatically sensed that the two trains were getting too close and stopped the train. One of the causes we had previously was that the operator had overridden the mechanical override, due to operating in manual mode. The investigation has shown that this was not the case, so we can cross out this cause. (We do not delete it from the map so that we know it’s been considered.)

Another potential cause of the ineffective mechanical override is sensor failure. The Metro General Manager has stated that there is no indication of sensor failure; however, there is no evidence that they were functioning properly so we leave it on our map while we wait for more information.

One other new piece of information has been presented. The speed limit at the location of the accident was 59 m.p.h. We’ll add that as a cause of “train moving at considerable speed.” (We still don’t know how fast the train was actually moving, as the train was not equipped with a data recorder.)

Click on “download PDF” to see how the changes were incorporated into the visual root cause analysis (Cause Map). The Cause Map continues to change throughout an investigation.

On June 22, 2009, the Washington, D.C. area suffered its first fatal Metro train crash since 1982.  A transit train smashed into another train that was stopped on the tracks.  There has been an apparent increase in crashes in large city’s transit systems over the last several months, causing some to question whether enough is being done to ensure an attitude of safety.  Robert Lauby, a former NTSB investigator, said:

“Just because you had them doesn’t mean there’s a specific issue that caused them.”

Actually, that’s exactly what it means.  If something happens (an effect), there has to be a cause.  Usually there’s more than one cause.  We can look at this incident in a root cause analysis to determine what some of the causes were.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The official investigation is still in its infant stages, but we can still put together a pretty thorough Cause Map.  (See the Cause Map by clicking on “Download PDF” above.)  We can add more detail to this Cause Map as the investigation continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

First we define the problem.  Here, it’s that two trains crashed.  We also enter the other identifying information (date, location and process.)  Then we frame the problem with respect to the impacts to the goals.  Here, the safety goal was impacted because at least 9 people were killed and at least 76 were injured.  The material goal was impacted because of severe damage to the trains. 

Next, we do the root cause analysis.  We begin with the impacted goals and ask “why” questions to find all the causes of the incident.  People were killed and injured because of the damage to the trains.  The trains were damaged because of a train, which was moving at a “considerable speed”  rear-ending a stopped train, and because of the  inadequate crashworthiness of the moving train.

The train was not adequately crashworthy because it was old, and not replaced (despite an NTSB recommendation to replace or retrofit the older cars to increase safety in a crash).  Why weren’t they replaced?  We don’t know yet, but the NTSB will be talking to Metro’s administration to find out.

The two trains collided because the train that was rear-ended was stopped on the tracks, waiting for another train to move.  The train that struck it did not stop or slow down.  The striking train was not equipped with a data recorder and the operator was killed in the incident, so we don’t have a very good idea of what happened.  But we can come up with some theories and then refine or reject them as evidence permits.  Since the train didn’t stop, it’s either because there was no attempt to stop, or the braking system malfunctioned.  From the information we have available, it appears that a train would not attempt to stop if the operator was unaware of the train, because she couldn’t see it and because the sensor system was not working properly,  AND if the mechanical override system was not working.  The sensor system not working might cause the mechanical override system to not work, OR the system could have been overridden by either the dispatcher or the operator.  (Apparently having the train in manual may turn off the mechanical override.)

We can continue to add to our root cause analysis as we get more information on the accident.

Enterprising companies know that finding new, effective solutions to problems makes good business sense.  Finding new solutions can be the difficult part.  A root cause analysis can help find new, effective solutions.  To demonstrate this capability, we’ll look at the problem of runway incursions at Los Angeles International Airport (LAX).  In 2007, there were 21 incursions at LAX.  Perhaps the problem was discussed, and it was determined that one of the causes of these incursions was that the taxiways intersected the runways.  This is shown below in a Cause Map, or visual root cause analysis.

A potential solution, then, is to install a taxiway between the runways, so that they don’t intersect.

This solution has been implemented at LAX, with the result of runway incursions dropping to 5 so far this year.  However, LAX officials would like that number to fall even further.  So they started looking for new solutions.  Finding new solutions may mean adding more detail to the Cause Map.  For example, what if we add another cause for runway incursions?

This gives us another cause that we can try to “solve”.  Here, the solution being implemented at LAX is radar-equipped warning lights.  Essentially, if the system senses a plane or vehicle that could lead to a potential collision on a runway or taxiway, the runway lights turn red.  If not, they are green.  The plane still has to request clearance from traffic control, but it adds another layer of protection.

Officials at LAX hope this will continue to decrease the number of incursions at LAX.  If not, the root cause analysis can be built into even more detail, and more solutions can be found.

On August 12, 2000, a torpedo exploded on KURSK, leading to the eventual loss of the submarine and all on board.  We can demonstrate the causes of the KURSK tragedy by performing a visual root cause analysis, or Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. First we define the problem(s).  Here, the problems include a torpedo explosion and submarine sinking.  This is the “what”.  The initial explosion on KURSK ocurred at 11:28 a.m. on August 12, 2000.  This is the “when”.  The KURSK (a Russian attack submarine) was in the southern Barents Sea, performing a torpedo firing drill.   This is the “where”.  We’ll also frame this incident with respect to the impact to the goals.  The safety goal was impacted because all 118 sailors on board were killed.   The materials goal was impacted because of the loss of the submarine.  There are other goals that were impacted, but for our basic analysis, we will stop here.

Next we perform the analysis portion of the root cause analysis. We can begin by using the “5-Whys” technique.  We start with the impact to the safety goal, and ask “why” 5 times.  For example: Why was the safety goal impacted?  Because 118 sailors died.  Why?  Because of the explosion of missiles and torpedo fuel.  Why did the missiles and torpedo fuel explode?   Because of the impact when the submarine hit the bottom of the ocean.  Why did the submarine sink? A torpedo exploded, breaching the hull.  Why?   A fuel leak on the torpedo.  The resulting Cause Map is shown on the downloadable PDF.  Though the resulting Cause Map is accurate, it’s not complete. 

We can add additional causes to make our map more complete.  For example, although 95 sailors were killed directly by the explosion, the remaining 23 sailors actually died from carbon monoxide poisoning because they were trapped in the aft compartment due to the submarine sinking. 

A higher detail Cause Map is also shown on the downloadable PDF.  Even more detail can be added as the root cause analysis investigation continues.  The level of detail in a Cause Map is determined by the impact to the organization’s goals.  Because of the tragically high number of deaths in this incident, it will be worked to a very high detail.  The highest detail level Cause Map has more than 150 causes.

June 3, 1998, a train derailed and crashed into a bridge near Eschede, Germany, killing 101 people, including 2 engineers who had been working on the bridge.  A thorough root cause analysis built as a Cause Map can capture all of the causes of this tragedy in a simple, intuitive format that fits on one page.We can begin our analysis with the “5 Whys” technique, asking “Why” 5 times.  1) Why did the train crash into a bridge?  It derailed.  2) Why did it derail?  A tire embedded in the railcar changed the switch.  3) Why was the tire embedded?  It had come off the wheel.  4) Why did the tire come off the wheel?  The tire broke.  5) Why did the tire break?  Fatigue cracking.  This forms the beginning of a root cause analysis investigation.

As we continue the investigation, we can create a more detailed root cause analysis.  We begin by defining the problem in terms of the impacts to the organization’s goals.  The safety goal was impacted because of the 101 deaths, and 88 injuries.  Also, the train suffered serious damage, resulting in an impact to the materials/labor cost goal.  These impacts to the goals form the basis for our Cause Map.

The goals were all impacted due to the destruction of the rear railcars.  This occurred because the train crashed into a bridge at 200 km/hour.  The train was not stopped or slowed because of company policy to investigate an  issue first.  The train crashed into the bridge because it had derailed because a tire embedded in the railcar collided with a switch guard rail.  The tire became embedded because it broke, due to fatigue cracking from wear and inadequate inspections, and an insufficient design.  The design was insufficient because the prototypes were not physically tested and dynamic repetitive forces were not considered in the modeling.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  Once the Cause Map is completed to the desired level of detail, solutions can be found for any of the cause boxes.  Solutions are then shown with the cause they control.

On the morning of August 23, 2006, a Comair flight scheduled to travel to Atlanta International Airport from Blue Grass Airport in Lexington, Kentucky attempted to take off  from the wrong runaway.  The runway used was too short and the flight crashed near the end of the runway.  There were 49 people killed and the single survivor was seriously injured.  The plane was destroyed by impact forces and fire. A previous blog discussed this accident and included a very high level 5-box Cause Map.  An intermediate level Cause Map is available for download that contains more information.

A root cause analysis shows that there are a number of causes for this accident.  When reviewing the Cause Map, the most obvious causes are that the pilots believed they were on the correct runway and that the air traffic controller didn’t stop the plane prior to the take off attempt on the wrong runway.

The investigation determined that the pilots had all the correct information during the taxi and take off attempt.  They knew the correct runway, had the correct magnetic headings and all markings on the taxi route met standards.  It isn’t exactly clear where the runway confusion occurred.

One piece of data that is available is that the pilot and copilot where having a personal discussion during the taxi, which is against regulations.  This isn’t necessarily the only reason for the runway confusion, but it most likely contributed to the accident.

Even with the runway mistake if the controller had realized that the plane was positioned on the runway prior to take off, the accident would have been prevented.  There are a number of reasons that the controller didn’t realize the runway mistake.  The first is the layout of the runways.  To get to the correct runway, you had to pass the hold position for the incorrect runway.  If the controller only quickly glanced out the window, the plane would appear to be on route to the correct destination when in fact it was lined up to take off from the wrong runway.

There was also only one controller on duty at the time of the accident.  He had to split his attention between tower tasks and radio duty.  There was no chance for watch team back up with only one controller in the tower.

The controller also didn’t believe it was necessary to watch the plane the entire taxi and take off.  There was no history of take off attempts on the wrong runway, multiple planes had already safety departed that morning and there was no other traffic on the runway. 

As with any accident, a root cause analysis shows that there are many causes that contributed to the outcome.  Even in a situation like this one where it is difficult create a solution that addresses every cause, the Cause Map shows that there are still ways to mitigate the risk.  Changing the way the controller monitors planes could help prevent similar future problems, even if the initial runway mistake occurred again.

Many of the examples of Cause Maps are investigations of an incident that has already taken place.  However, cause maps are also very useful as a proactive, preventative tool.  A thorough root cause analysis built as a Cause Map can capture all of the potential causes of concern in a simple, intuitive format that fits on one page.  Let’s say you have decided to get a pool for your household.  A Cause Map can help you identify the potential hazards of pool ownership, provide solutions for them when possible, and ensure that your pool experience is as safe as possible.  

Preventing pool injuries is extremely important.  About 43,000 people each year are injured in and around swimming pools and 600 people drown.  Of the 600, approximately 260 are children under the age of 5.  Half of pool drownings occur in the yards of single-family homes.  Obviously, drowning is a concern when discussing pool safety, but the other top causes of injuries around pools are head injuries, slipping, and electrocution.  Some solutions to these problems are listed below, and are based on causes derived from the Cause Map. (To see the Cause Map, click on “Download PDF” above.)

POOL SAFETY SOLUTIONS:

1) Control access to the pool by using a self-latching, self-locking fence that is at least 4′ tall, that can’t be climbed.  Ensure the doors open outward from the pool and have a latch out of children’s reach.   Use a safety cover when the pool is not in use.
2) Employ drain safety devices such as pumps that shut off automatically when the pipes are obstructed.
3) Keep children within arm’s reach when near a pool.  Don’t put in a pool for your family until your children are at least 5.
4) Keep lifesaving equipment near the pool, including a hook and an approved life-saving flotation device.
5) Don’t drink & swim, and don’t let those who have consumed alcohol near the pool.
6) Take your whole family to swimming lessons.
7) Never swim alone.  Don’t let anybody else swim alone.
8) Use a pool alarm that senses water motion to determine if someone has entered the pool.  Make sure it is always turned on when the pool is not in use.
9) If a child is missing, look first in the pool (most children who drown are found after 10 minutes). 
10) Keep a telephone, and emergency numbers, near the pool at all times.
11) Check the water depth before diving, or don’t allow diving in your pool.
12) Learn CPR.  Take your whole family (when they’re old enough) to CPR lessons, too.
13) Don’t allow running near the pool.
14) Use an absorbent material to surround the pool.
15) Use rough material around the pool (such as cement instead of tile).
16) Stay out of the pool during rain or lightning storms.
17) Keep electrical appliances away from the pool (they can cause electrocution even if they are not turned on).

On September 22, 2008 American Airlines Flight 268 en-route from Seattle to JFK Airport made an emergency landing at Chicago’s O’Hare Airport.  Nobody was injured, although the landing gear sustained some damage.  In order to determine what went wrong, we will perform a root cause analysis.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.First we’ll look at the impact to the goals.  An emergency landing is an impact to the customer service and production/schedule goal.  Additionally, the damage to the landing gear is an impact to the material/labor cost goal. We begin with the impacts to the goals, then ask “Why” questions to fill out the Cause Map.  For example, the damage to the landing gear occurred because the pilot steered the plane off the side of the runway.  The pilot steered the plane off the runway because of an obstruction at the end, and because of control issues, which occurred because of a failure of multiple cockpit systems.  The failure of these systems also caused the emergency landing.

The failure of the cockpit systems was caused by the battery power being depleted and not being recharged.  This occurred because the battery was powering four systems, and was disconnected from the main battery charger.  This happened because the standby power selector switch was moved to the “BAT” (or battery) position.  The standby selection switch was moved to battery because that is what procedure called for when the “Standby Power Bus OFF” light is illuminated.  The light was illuminated due to a relay failure, of unknown cause. 

At this point, a problem becomes clear.  A pilot following procedure should not result in an emergency landing for a plane.  Thus, we have a procedural problem.  We will use a Process Map to draw out a procedure for more clarity to see where the specific issue lies.

Based on general information presented by the National Transportation Safety Board (NTSB), the illumination of the “Standby Power Bus OFF” light indicates a loss of power to the standby AC or DC bus.  If this occurs, the standby power selection knob should be turned to “BAT” (battery).  The battery should provide standby bus power. If the “Standby Power Bus OFF” light goes out, the standby power selection knob should be turned to “AUTO” which restores the battery charger. 

Written in a paragraph, it can be difficult to see where the issue is.  But if we put it in a Process Map, we see a decision box for “Standby Power Bus OFF light remains illuminated.  If the answer is yes, we follow the procedure outlined above.  But if the answer is no, there is no procedure to follow.  This is the position the pilot of Flight 268 was in.  The “Standby Power Bus OFF” light went out, so the pilot left the standby power selection knob on “BAT”.  This drained the battery, resulting in the failure of various cockpit systems, as discussed above. 

Even more detail can be added to this Cause Map as the root cause analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.

In January, 2009, health officials discovered Salmonella typhimurium in a jar of peanut butter.  The Food and Drug Administration (FDA) was able to trace the contamination back to the Peanut Corporation of America (PCA)’s  Blakely, Georgia plant.   A root cause analysis built as a Cause Map can show the causes of this tragic, preventable incident in a simple, intuitive format that fits on one page.

To begin our root cause analysis, we start with the impact to the goals.  The peanut products contaminated with salmonella resulted in 700 reported illnesses.  This is an impact to the safety goal.   Also, PCA received a $14.6 million fine for shipping products contaminated with Salmonella.  This is an impact to the regulatory goal.  There are other goals that were impacted as well, but we will begin with these two.

People were sicked and PCA was fined because peanut products contaminated with Salmonella were shipped to consumers.  These products were able to be shipped because they were retested for Salmonella until the results were negative (this is illegal, by the way) and several lots of product were contaminated.

The product lots were contaminated because the processing line was exposed to Salmonella and was not cleaned after the contamination.  The two likely ways that the line was contaminated is either by exposure to rain (which can carry Salmonella) or by cross-contamination of finished product (which should have any microorganisms destroyed in the roasting process) and raw product (which hasn’t).  Additionally, the roasting process in the Blakely plant was inadequate to kill Salmonella.

The plant suffered from inadequate cleaning, which resulted from a line that was not able to be adequately sanitized, and from inadequate supervision.  The FDA had last inspected the plant in 2001, which is typical due to understaffing.   However, they might have visited sooner if the Salmonella test results (the ones that were re-done to get negative values) were shared with the FDA.  These results were not shared with the FDA, which is common industry practice.    State inspectors found only minor issues.

None of PCA’s customers appeared to have visited the site, possibly because they relied on an audit firm’s “superior” ranking.  This audit firm was paid by PCA.  There was also inadequate supervision due to inadequate leadership at the plant, which had no plant manager for a portion of 2008, and was missing a quality manager for four months.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals. 

On July 17, 1981, the second and fourth floor suspended walkways collapsed at the newly opened Hyatt Regency of Kansas City, Missouri.  A dance contest had attracted a crowd and the atrium under the walkway was filled with people.  This accident killed 113 people and injured 186.

The hotel was newly constructed and the walkways were well maintained.  So how did this happen?

A root cause analysis of this accident shows that there were a number of causes that contributed to the walkways collapsing.  Investigation into the accident shows that the structural design of the walkway was inadequate.  A weld failed which allowed a support rod to pull through the box beam and the walkways fell.

Additionally, the weld had greater stress than normal on it at the time of the failure because a large crowd had gathered to watch a dance contest.  About 20 people were on the second floor walkway and about 40 were on the fourth floor walkway at the time of the accident.  The higher loading combined to the walkway collapse.

Identifying the failure mechanism is important during an investigation, but a thorough root cause analysis is needed to really understand the causes.  The reason that an inadequate design was built needs to be determined.

In this case, it appears that the design was changed without approval of the structural engineer.  This resulted from a communication error between the fabricator and the structural engineer.  The structural engineer sent a sketch of a proposed walkway design to the fabricator, assuming that the fabricator would work the details of the design himself. The fabricator assumed the sketch was a finalized drawing.

The fabricator then picked standard parts to fit the sketch.  This resulted in a significant change from the original design and dramatically decreased the load bearing capacity of the walkways.

The original design called for continuous hanger rods (a non-standard part that would have needed to be manufactured) that passed through the fourth floor walkway beam box to the second floor walkway, resulting in the ceiling connecting supporting the weight of both walkways.  The fabricator changed the design to use two shorter rods (standard parts) which resulted in the fourth floor walkway supporting the weight of the second floor walkway, which it wasn’t designed to handle.

It’s important when performing a root cause analysis that the problem is investigated beyond the point of inadequate design to learn what failed in the design process to prevent future accidents from occurring.

On April 26, 1986, reactor #4 at the Chernobyl Power Plant exploded, spreading radioactive contamination.  There is much debate about the effects, the magnitude of the effects, and the causes, but we can put together a summary of the root cause analysis here. 

It is estimated that thousands (perhaps tens of thousands) of people will die from the aftereffects of Chernobyl.  More than 4,000 children have contracted thryoid cancer.  Additionally, between 50 and 250 million Curies of radioactivity were released, more than 350,000 residents have been resettled, a large area remains contaminated, and over 20 countries received radioactive fallout.

The radioactivity, which had built up in the reactor, was released by an explosion and a fire that occurred due to an uncontrolled power surge.  Inadequate containment resulted in the radioactivity spreading beyond the plant.  The power surge resulted from several actions that increased power and disabled safety systems, and from an unsafe reactor design.  (The reactor was designed so that increased steam production leads to an increase in power. US reactor designs are the opposite.) 

The after-effects of Chernobyl continue.  The applications of lessons learned from root cause analysis have been applied in many areas – nuclear power, evacuation planning, radiation health treatments, and food supply.  The only remaining reactors of this type are being shut down.  Hopefully this will not ony ensure that another Chernobyl never occurs, but will also improve the safety of many other industries. 

Once you’ve finished your root cause analysis, determined what the causes of a given incident are and built the Cause Map, now comes the really important part: how do you make sure it never happens again?  To keep an incident from happening again, an organization needs to implement solutions. The first step to implementing solutions is to find possible solutions.  We do this by brainstorming.  The brainstorming process is made easier by the root cause analysis, because instead of finding a solution for “person falls down stairs” we brainstorm solutions for very specific causes, such as “stairs were wet” and “handrail doesn’t extend far enough”.  There are many different methods for brainstorming, but the important point is: don’t discount any suggestions.  Write them down, and move on.  We’ll sort through them later.  Attach the solutions to the causes they control (for example, a solution to “stairs were wet” is “cover stairs from exposure to rain”).  Some causes won’t have any solutions, and some solutions will appear on more than one cause.

Have a wide variety of personnel available for brainstorming.  Sometimes it’s easier for someone farther from the work to see potential solutions, and sometimes the people who do the work every day will have great suggestions they’ve been waiting to bring up.  The more suggestions, the better!  Sometimes a seemingly crazy suggestion will lead to a very practical solution.  Allow people to add on to others’ suggestions.  This can result in a synergistic solution better than the original suggestion.

Once the brainstorming is complete, you’ll have a list of possible solutions.  There are as many ways to select solutions as there are to brainstorm, but I suggest something like the following.  First, make a list of the solutions.  Rate the effectiveness of each solution at preventing similar types of incidents (from 1 to 10, 1 being not very effective, 10 being very effective).   Then rate the ease of implementing the solution (from 1 to 10, 1 being not very easy to implement, 10 being very easy to implement).   Multiply the two together for each solution’s score.  Then, rank the solutions.  The solutions at the top will give you the most “bang for your buck”, or are the most easily-implemented, effective solutions. 

On May 14 2007, the 300 foot cruise ship, Empress of the North, grounded out on rocks while rounding Rocky Island during a trip through Alaska’s Inland Passage.  There was significant damage to the hull and the two starboard propellers needed to be replaced.  Costs of repairs totaled more than $4.8 million.  Luckily no one was injured, but over two hundred passengers had to be evacuated from the ship.

This is a common route for cruise ships and the rocks were a well-known hazard clearly marked on navigation charts.  So what happened?

A root cause analysis shows that there were many causes that contributed to the accident.  One of causes is that there were no lookouts at the time of the accident.  The crew members who would have acted as lookouts were performing security rounds.  This was in violation of regulations requiring lookouts at all times and appears to have been a common practice for the crew.

When determining causes it’s important to ask, what is different?  In this case, this was the first watch as Deck Officer for the officer in charge.  He had recently graduated, was newly licensed and inexperienced.  He was not familiar with the deck procedures and the equipment. There was a lot of confusion about watch team roles and he didn’t attempt to take charge of the ship’s navigation until seconds before the grounding occurred.  The National Transportation and Safety Board found that the actions, or inaction as the case may be, of the Deck Officer were one of the major factors contributing to the accident.

It’s tempting to stop at this point, but the analysis needs to go farther than just identifying the actions of the Deck Officer as a cause to do a thorough investigation.  Why was he standing watch if he wasn’t fully qualified?  Why wasn’t he prepared adequately prior to being given the responsibility?

The crew member originally assigned the watch was ill.  There are a limited number of possible replacements on a ship this size.  The Master of the ship believed the watch would be a good training watch because it was an easy watch with minimal course corrections needed.  It was also not the practice of the crew to have specific night orders for the overnight watches so the newly arrived junior third officer found himself standing the midnight to 4 am watch with minimal guidance.

Many investigations lead back to human error, but it’s important to ask questions beyond that point.  Changing how people are trained, improving the environment, and providing specific writing inspections can help prevent human errors in many cases.

(The photo above is an official Coast Guard photo.)

The occurrence of dog attacks is a significant ongoing problem.  An estimated 4.5 million people are attacked each year, of which 800,000 seek medical care.  These statistics only include attacks that were significant enough to be reported, so the actual incidence is no doubt larger.  One action that has been taken to reduce the incidence of dog attacks is banning specific dog breeds associated with aggressive tendencies (mostly large breed dogs like Pit Bull Terriers, Boxer Dogs, and German Shepherd Dogs), known as Breed Specific Legislation (BSL). 

Although BSL is gaining popularity, it does not address all the causes of dog attacks.  A root cause analysis of dog attacks identifies factors related to the dog (inherent temperament, socialization, protective tendencies, location and level of restraint), the owner (treatment and control of the dog) and the victim (behavior, location, age and experience with dogs).  The etiology of a dog attack is multifactorial and as such, should be dealt with in a broad and diverse approach.

Some suggested alternatives to BSL that take into account the complex nature of dog attacks and are targeted at preventing all dog attacks follow:

- Education about proper behavior around dogs would greatly decrease the potential for dog attacks.  Approximately 80% of attacks are by a known dog and more than half of attacks are against children under 12, suggesting that human behavior around a dog is an important trigger since children are more likely to engage in activities that may be perceived as threatening (such as loud noises, running, improper touching). 

- Proper enforcement of existing legislation is a readily available method of reducing dog attacks, as many municipalities have restraint laws that are poorly enforced.  An attack cannot occur without the interaction of a dog and person.  Proper restraint on and off private property would reduce the potential for attacks. 

- Stricter regulations and more frequent inspections of breeding operations could play a role in reducing improper treatment of young dogs.  Early socialization plays a large role in that puppies that have little interaction or negative interaction with humans are more likely to develop aggressive tendencies.  In most cases this early interaction occurs within breeding operations.

- Encouragement of voluntary spaying and neutering takes advantage of a widely available procedure to reduce the potential for dog attacks.  One of the most significant predictors of attack is a sexually intact dog.  Outside of a breeding operation there is little reason for not spaying or neutering, and the procedure can have additional benefits for the health of the animal, help control the dog population, and reduce unwanted dogs.

To view the PDF file including the root cause analysis of a dog attack, please click “Download PDF” above.

On July 25, 1956, the Andrea Doria (an Italian luxury passenger liner) was struck off Nantucket by the Stockholm (a Swedish passenger liner).  Andrea Doria was struck head on, which was bad enough.  What made it even worse was that Stockholm was outfitted with a reinforced icebreaking bow for its travels in frigid waters.  If you look at the severe damage to Stockholm’s reinforced bow (estimated to be $1 M in 1956 dollars), it’s no surprise that Andrea Doria suffered fatal damage. 

Although one lesson we can take from this is to never be arrogant enough to call your ship “unsinkable”, we can perform a root cause analysis into the tragedy to determine what else went wrong.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

First, we look at the impact to the goals.  51 people were killed (46 on Andrea Doria, 5 on Stockholm).  This is an impact to the safety goal.  The $29 million (in 1956 dollars) Andrea Doria was a total loss, and  Stockholm suffered $1 million worth of damage.  These are both impacts to the material goal.

When Stockholm struck Andrea Doria, it ripped a 50×30 foot hole in Andrea Doria.  This compromised Andrea Doria’s watertight compartment system (one of the features that made it “unsinkable”), so it began to take on water.  Within 5 minutes of the collision, it was listing 20 degrees starboard.  It was designed to stay afloat with a 15 degree list (another “unsinkable” feature), but not as much as 20, so the ship sank.

Now, why did the Stockholm’s bow strike Andrea Doria’s side?  Stockholm turned starboard, trying to avoid Andrea Doria because they were on a collision course.  The turn was insufficient because of a delay in response time by Stockholm while they plotted the course of the oncoming vessel, which was standard procedure, and because their speed was not reduced.  Both the delay and the speed not being reduced were partially caused by an inexperienced watch – a 3rd mate was in charge and he was the only officer on deck.  It is also believed that the navigator on Stockholm was unaware of the fog.  (Note that although Andrea Doria was in extremely thick fog, Stockholm sailed in clear skies until just before the collision.)  Andrea Doria’s starboard side was exposed because they made a hard left turn, attempting to avoid Stockholm, which was also insufficient due to their speed, which was not reduced sufficiently because the ship was trying to make good time.  Operations in fog call for “moderate speed”, which is defined as the speed at which a ship could be stopped within its visibility distance.  Andrea Doria’s visibility was 1/2 mile, while its stopping distance was far greater.  (While Stockholm had not yet reached the fog, Andrea Doria was already in it, which would seem to be reason enough to reduce speed.)  We’ll also tie the fact that they were on a collision course as a reason for the impact.

How did the two ships get on a collision course?  Andrea Doria made an unexpected turn, to attempt to pass Stockholm starboard to starboard, despite the fact that ships normally pass port to port, per rules of the road.  They did this because they believed Stockholm was already to their starboard side.  They were unaware of Stockholm’s course because they did not plot it (possibly because the Captain was relying on his two state of the art radar systems).  Additionally, Stockholm was north of its recommended route, because the recommended route added distance and time, and was very crowded.

Stockholm turned starboard, to try and avoid Andrea Doria; however, Stockholm had miscalculated Andrea Doria’s position and course, partially due to ineffective navigation on Stockholm.  (Either Stockholm’s radar was providing incorrect data  or, as some experts believe, the radar data was being misinterpreted because the scale, which had to be manually set, was on the wrong setting.) 

The ships also suffered from a lack of communication:  Stockholm was not using proper signals (its fog horn and turn signal).  There was no visual contact between the ships due to reduced visibility from fog and the fact that the ships were traveling at night.  Also, there were no radios to communicate between the ships (a fact that has thankfully been remedied).  The attached PDF, available for download, has a high-level visual root cause analysis (cause map) of the incident.  Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals.  (In the case of Andrea Doria, the high level cause map has 16 boxes; the detailed map has more than 100.)

Early this morning, the USS New Orleans (an amphibious ship) and the USS Hartford (a nuclear-powered submarine) collided in the Strait of Hormuz, near Iran.  The details of the collision are pending an investigation, but we can begin a root cause analysis based on what we know so far.

There were 15 submariners who received minor injuries, which is an impact to the safety goal.  25,000 gallons of diesel oil were spilled from the New Orleans, which is an impact to the environmental goal.  The incident resulted in an increase in oil prices, which we will consider an impact to the customer service goal.  There was the potential for disruption to traffic in the Strait of Hormuz, which is a major shipping channel, so we will consider that an impact to the production goal.  Finally, there was “significant” damage to the submarine’s sail and a ruptured fuel tank on the ship, which are both impacts to the materials goal.

We’ll look at the injuries first.  In our basic root cause analysis, the injuries were caused by the collision of the ship and the submarine.  The collision also caused the damage to the submarine’s sail.  The diesel oil leak was caused by a ruptured fuel tank on the ship.  The fuel tank rupture was also caused by the collision.  The collision also caused the potential for disruption in the Strait, through which 40% of the world’s sea-transported oil is shipped.  It was because of this potential that oil prices were increased.   (The U.S. Navy has stated that both vessels have left the strait and shipping was not disrupted.)

So, what caused the collision?  This is where we’re somewhat lacking in details, but we can make some guesses.  In order for the submarine and ship to collide in the Strait, they both had to be in the Strait.  They were both in the Strait heading to ports in the Persian Gulf to stock up on provisions.  It is likely that the collision occurred because the ship and the submarine were unaware of eachother.  The submarine was submerged, so the ship wouldn’t be able to see it visually.  Additionally, submarines are designed to be practically undetectable by ship’s equipment.  A remaining question is why the submarine was unaware of the ship.  We will be able to fill in more detail on our visual root cause analysis (or cause map) as more information comes to light.  Click on the “Download PDF” button above to see the cause map associated with this incident.

On Thursday, March 12 2009, the astronauts in International Space Station had to evacuate the station because of a near miss with space debris.  The debris was approximately 5 inches across and traveling at nearly 20,000 miles per hours so a collision could have resulted in significant damage. 

For safety reasons, the astronauts entered the Soyuz, a Russian space craft kept at the space station, for ten minutes.  The hatches between the station and the Soyuz were soft latched so that they could be closed quickly if needed and the crew could depart the station if it was damaged.

A root cause analysis of the incident shows that there are number of causes that contributed to the event.

One of the causes was late identification of the possibility of a near miss.  Typically, the station is maneuvered out of danger if the trajectory of space debris is predicted to be close to the station.  This has been done eight times in the eight years that the station has been occupied.   In this case, the debris wasn’t spotted early enough to coordinate the maneuver, so the crew had to be evacuated.  The press reports didn’t give specifics on why the debris was identified late, but the size, speed and volume of typical space debris creates a tough challenge in tracking possible near misses.

A second cause is that it is difficult to maneuver the space station.  It is not a vehicle with an easily changed orbit so each move takes time to calculate and coordinate.

The international space community keeps a space craft at the station at all times for use as a life boat by the crew if necessary to prevent injury from debris strikes.  Hopefully, the crew will never have to test it out first hand.

There’s the obvious definition of “human error”: someone just screws up.  They know they’re supposed to do it a certain way, they’ve been trained, they’ve done it a million times the correct way, and they just do it wrong, this one time.  However, there’s not really a solution for human error – except to employ only self-programming robots – but our mission when we perform a root cause analysis is to find solutions.  So in order to better our process to prevent problems from occurring, we need to branch out from human error and figure out what’s really going on.
 
If one person making a mistake can cause a problem that is either so troublesome or so common that you’re performing a root cause analysis, then the safeguards on the process really need to be more robust.  So a cause in this case is “human error” but it’s also “inadequate safeguards.”  THAT is a cause that we can do something about. 

Upgrading your safeguards does not always mean adding additional safety hard- or soft-ware.  Sometimes it means backup in the form of additional staff.  For example, one of the underlying causes of at least two famous ship collisions was an inexperienced bridge watch.  On the bridge of EXXON VALDEZ when it struck Bligh Reef and STOCKHOLM when it hit (and sank) ANDREA DORIA were Third Mates who were not only running the bridge, they were the only officers present.  They made some “human errors” with disastrous consequences that would have likely been avoided (or at the very least, mitigated) with someone else there for backup, or a more experienced officer at the wheel.

Another “solution” to human error is regulations and guidelines.  Much human error is caused by fatigue or distraction.  Another issue on the EXXON VALDEZ was that the Third Mate discussed above had had very little sleep in the days preceding the grounding.  When we discover a reason for an operator/worker/driver to be making errors, such as not getting enough sleep or being distracted by collateral duties, we can change our regulations.  The National Transportation Safety Board found that Exxon Corporation’s policies did not require adequate sleep and in fact encouraged employees to take additional duties that prevented them from getting adequate sleep.  There was a collision on the Washington, D.C. metro train system in 2004 where root cause analysis showed that the operator on a train that rolled back into another train did not press the brake.  The cause was cited as exhaustion.  The operator worked a double shift (8 a.m. to 11 p.m.) the night before, as well as 9 other instances in the previous month.  There are no service-hour regulations for train operators, and the Washington Transit Authority policy did not provide adequate time for sleep. A solution to “human error” in both these cases is to adjust policies and regulations to require adequate rest before performing potentially dangerous tasks.

A last consideration when confronted with human error: the problem may not be the procedure but the application of the procedure (i.e. “Procedure not followed”).  If the explanation for why a procedure wasn’t followed is “everybody does it this way” then the problem is either with the procedure, or with training.  For example, ANDREA DORIA (which I mentioned above) was struck by STOCKHOLM and sank.  One of the contributing factors was that her fuel tanks (which were required to be filled with water when emptied of fuel for ballast) were empty.  So, the tanks on the collision side filled with water and the tanks on the other side provided lopsided buoyancy.  The result was a twenty-degree list five minutes after the collision.  Testimonies stated this was common practice because cleaning seawater out of fuel tanks was an arduous task that engineers would prefer to avoid.  So, Captains obliged and ignored the requirement to use fuel tanks as ballast.  This was a legitimate concern by the engineers, especially for ships on tight schedules and run for profit.  But either these concerns never made it to the right people or they were ignored and the result hastened the fate of ANDREA DORIA.  Now, as a result of this accident, ships are required to have separate tanks for ballast.

The other side to human error/procedure problems may be inadequate training.  A step that is seemingly senseless in a procedure may likely be ignored.  If there is a reason for the procedure, it needs to be communicated clearly to all employees.  For example, a corporation that made metal sheets for manufacturing labeled the sheets in two places, at one end and at the center of the board.  However, the end of the board was cut off and not sent further down the line.  So, employees stopped adding the second label.  What they didn’t know is that the end of the board was send to metallurgical testing as a coupon sample to verify the heat treatment of the rest of the sheet (which was used for manufacturing).  The sheets that had unlabeled coupons were unable to be used without further testing, causing a delay in the line, and possible disposal of material.

The bottom line here is: Never stop with human error while performing a root cause analysis.  Figure out if there was another cause for the human error and if not, figure out if your organization can live with the potential for another “I just screwed up” human error.  If not, you’ll need to examine additional safeguards.

Fire used to be simple.  There was the fire triangle, which said to make a fire you need heat, fuel and oxygen.  Easy, right?  Unless you’re working in a vacuum, there’s pretty much always oxygen around, a match provided the heat, and all you needed to provide was some wood (or other flammable material, hopefully not valuable).  Girl Scouts and Boy Scouts could explain it in the first grade.  The root cause analysis was equally simple.

But then somebody took a closer look.  Somebody who was perhaps not familiar with root cause analysis but who realized that if you had a solution (such as halon fire extinguishers) that did not directly address one of the causes (heat, fuel and oxygen), then there was something missing in your equation.   The missing link was an uninhibited chain reaction.  Halon fire extinguishers (as well as some other types) work by interfering with the chain reaction.

When we attempt to turn the fire tetrahedron into a visual root cause analysis (cause map), it’s not quite as simple as adding “uninhibited chain reaction” as a fourth case pointing directly to fire.  What actually happens in a fire is that a fuel is heated to the point of ignition.  At this point, it dissociates and produces free radicals.  The free radicals combine with the oxygen.  This reaction releases heat and visible light (the fire) and reaction products like CO2 (smoke).  If the heat released is sufficient to keep the fuel above the ignition point, the fire continues.  This is the uninhibited chain reaction.  

This demonstration illustrates how important it is to fully develop a cause map to ensure that all causes are present so that all solutions can be found.  (A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.)  If the smaller cause map had been used to develop solutions for extinguishing or preventing fires, an important type of firefighting device may not have been examined.  Only when we find all the causes can we find all the solutions.

On August 14, 2003, over 50 million people in the U.S. and Canada were without power, some for several days.  Damages from the loss of power – including damaged refrigerated items and looting – totalled approximately $6 billion (U.S.).  508 generating units shut down, resulting in the loss of border and port control systems.  After the blackout, a U.S.-Canada Power System Outage Task Force was appointed to investigate the cause.  We will use the data they obtained to perform a root cause analysis of the event.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The blackout was triggered by a shut-down cascade, unsustainable power surges in numerous transmission lines.  This occurred due to a supply/demand mismatch – a large decrease in available power without load shedding (where operators drop some consumers off the grid to prevent outages).  Operators did not shed loads because they weren’t warned of impending outages, due to a lack of communication from FirstEnergy, the company whose lines began shutting down first, and a lack of warning by the regional coordinator.

The decrease in available power was due to a key transmission line being shut down.  This happened because the line contacted overgrown trees when it sagged due to a power surge because other, smaller lines shut down when they sagged and touched overgrown trees.  The lines originally sagged due to power surges caused by an automatic shutdown of a power generating unit.  The power surge could have been stopped by operators shedding loads, but they did not because they were not immediately aware of problems, thanks to a failure in their grid monitoring equipment, and due to a lack of training.

Due to the complexity of the event, it is possible to make a much more detailed Cause Map.  As with any investigation the level of detail in the root cause analysis is based on the impact of the incident on the organization’s overall goals.  For example, this map has 21 boxes.  The detailed map that includes the findings of the Task Force has more than 70 boxes, and is at a more appropriate detail to find solutions to ensure that this sort of energy reliability problem does not happen again.

Currently, more than 43 million Americans smoke.  Why does this happen, and what effect does it have?  We will do a very simplistic root cause analysis.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. 

Smoking leads to an estimated 440,000 premature deaths each year.  This includes deaths caused by smoking and by exposure to secondhand smoke.  Additionally, 8.6 million people suffer from smoking-related illnesses.  And, 900 infant deaths are caused annually from smoking during prengnancy.  These are all impacts to the safety goal.  The deaths and diseases are caused because smoking raises the risk of cancer, cardiovascular disease, and respiratory disease.  The first two are caused by exposure to tobacco smoke (including secondhand smoke) and the third is caused by inhalation of smoke.  Either way, the cause is that many people smoke cigarettes.

Why do people smoke?  Well, it’s because they start smoking and because it is extremely difficult to quit.  There are many reasons why it is difficult to quit.  Some of these reasons are: cigarettes are extremely addictive, severe withdrawal symptoms cause relapses, smokers have a lack of assistance in quitting, they are afraid of weight gain, and there is a lack of increase in the cost of cigarettes.  This last one sounds odd, but studies have shown that an increase in the cost of cigarettes decreases the number of smokers.  However, the cost of cigarettes does not reflect the true cost of cigarettes (based on health costs and productivity losses), and the small increase in taxes (which has not kept up with inflation) is offset by cigarette company promotions. 

People start smoking because of the positive imagery of smoking – the heavy advertising and promotion of cigarettes, smoking in popular culture (mainly movies), and the lack of counter-advertising by federal organizations and anti-smoking campaigns.  Additionally, most smokers (90%) start as children (before the age of 18) because cigarettes entice children, there is a lack of counseling against their use, teens may suffer from peer pressure encouraging, and teens are more susceptible to addiction than adults.

Centralia, Pennsylvania is a town on fire . . . literally.  Since a fire was lit to burn garbage above an old mine entrance in 1962, the fire has spread to bored out coal tunnels that spread out underneath the town.  We can visually lay out what is happening in Centralia, which has been condemned and is now populated by only a handful of loyal residents, with a cause map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

Centralia has health concerns from poisonous gases released from burning.  These gases are also an environmental concern.  These gases are released because the fire continues to burn.  What does every fire need?  Heat, fuel, and oxygen.  Well, the heat is provided by the fire that was lit back in 1962.  The supply of fuel (coal) is nearly endless, estimated to last for 250 years.  And there is a near endless supply of oxygen, as the coal is exposed to air.  This occurs as the ground opens up (causing the risk of structural collapse) when the coal turns to ash, which lacks the strength to hold the ground up.  The coal turns to ash as it burns.

Rather than put the fire out, which would be exceedingly difficult and very expensive, the residents of Centralia were relocated.  Amazingly, towns like Centralia, with constant fires burning underneath are not uncommon.  Pennsylvania itself has dozens of these fires.  China and India have even more, thanks to their need for energy for rapidly growing nations and their lack of regulation. 

There’s not much to be done with Centralia, except wait.  And the only way to prevent further Centralias are with very careful mining regulations and upkeep.  Unless the government changes its mind, Centralia will continue to burn, until the coal finally runs out.

Sometimes, what seemed like a simple problem at first glance is really a much more complex issue. When performing a root cause analysis, it’s important to understand all the causes contributing to the outcome, not just the most obvious one. When a solution is implemented it can have unintended negative consequences if the entire system is not well understood.

Take the example of Macquarie Island. The population of non-native feral cats on Macquarie Island had grown out of control and was threatening the native bird populations. It seems like a simple problem. Remove the predator, in this case the cat, and the population of their prey will increase. This is exactly the approach taken by conservationists on the island and the last cats were removed in mid-2000.

Recently, the scientist at the Australian Antarctic Division discovered that removing the cats has resulted in widespread environmental devastation because it allowed the rabbit and rat populations on the island to explode. The ever increasing number of rabbits had eaten significant amounts of the vegetation on the island, leading to major erosion issues. The increase in the number of rats is a threat to the bird population because they feed on young chicks. Obviously, the cats weren’t the only cause that needed to be addressed if the island and its inhabitants were to be preserved.

The rapid increase in rodents was possible because rabbits and rats had no natural predators because they are also non-native to the island. Rats were inadvertently introduced to the island by ships. The cats were purposely bought to the island to help control the rodent population and protect the human food stores. Rabbits were also deliberately introduced to the island to serve as a food for sealers.

The solution to the problem needed to be more complex than simply removing cats. To restore the island and its native inhabitants to their natural state, all non-native species needed to be removed at the same time.
A high-level cause map of the problem is below:

On June 5, 1976, workers were called to the Teton Dam to attempt to repair a leak.  Workers in bulldozers narrowly avoided being sucked into the dam with their equipment, and watched helplessly as the dam was breached.  It would kill 14 people and cause nearly $1.5 billion in property and environmental damage and claims.  To examine what went wrong, we will perform a root cause analysis.   A summary of the analysis can be viewed in the 1-page pdf document.

People were killed due to a massive wave of water released from the dam (which was filled to capacity) when it failed.  The failure caused severe damage to the dam, which was never rebuilt.  Erosion and inadequate strength led to the failure.  Due to the less than ideal geological conditions of the site (which was picked because there were no “good” sites available), unequal stress distribution and inadequate fill material (which was used from the site) led to reduced strength.  Susceptibel materials and seepage from leaks in the embankment, caused by joints that were not resistant to water pressure due to inadequate testing, and inadequate protection from water due to an over-reliance on an ineffective curtain intended to stop flow, led to the erosion.

Many geologists had predicted problems with the dam before it was built.  Although tragic, and expensive, the failure of the Teton Dam did lead to many reforms in the Bureau of Reclamation, who is responsible for dam safety.

In 2006 in Indianapolis, 6 newborns were given adult doses of the blood thinner heparin.  Adult doses are 1000x more concentrated than infant doses.  Three of the babies died.  In 2007, in Los Angeles, the same thing happened to three babies.  Luckily none of those babies died.  (The heparin overdoses that occurred in Texas in 2008 were caused by a different type of error.)

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

Overdoses of this sort impact the patient safety goal because they can result in fatalities and injury to newborns. 

In order for this to have occurred, there were 5 opportunities for double-checking the dosage that were missed. 

The wrong dosage was missed as 1) the bottle was removed from the pharmacy, 2) the bottle was placed in the cabinet, 3) the bottle remained in the cabinet, 4) the bottle was taken from the cabinet, and 5) the drug was adminstered to the babies.  Some of the reasons that it was missed: there was no effective double check by another staff member, there was no check by a computer and of course due to human error, which was aided by the issue that the adult dosage bottle and the infant dosage bottle looked practically identical (this has since been remedied).

Many solutions to this type of error (such as requiring double checks by staff members and using a computerized prescription dispensation system) are already being implemented at hospitals across the nation.

On the afternoon of September 12, 2008, a Metrolink commuter train collided head-on with a Union Pacific freight train.  This tragic accident resulted in the deaths of 25, and injured 135, one of the worst train collisions in the country.  The National Transportation Safety Board (NTSB) is investigating the collision, but from primary information we can make a basic cause map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

We’ll examine the impacts to the goals from the point of view of Metrolink, who operates the commuter rail.  There was an impact to the safety goal because 25 (20 passengers, 5 crew) were killed, and 135 were injured.  The customer service and production goals were both impacted because rail service has been suspended.  Additionally, there was severe damage to both trains, though the total cost is not yet known.

The suspension of service is due to the damage to the trains.  The deaths, injuries and damage to the trains were caused by the impact force.  The impact force is a result of the head-on collision of the two trains, which were both estimated to be traveling at 40 m.p.h.  (Whether or not that is a typical or accepted speed is not yet clear.)  The head-on collision occurred because the two trains were sharing the same tracks.  There is only a single track in this area because of a narrow tunnel, and the commuter train did not pull over onto siding (as occurs nearly almost every day so the freight train can pass).  The train did not pull over because the engineer failed to stop.  Whether that is because he didn’t follow protocol, didn’t notice the signal because of glare, fatigue, or other distractions, or if the signal malfunctioned is not yet known.  (A preliminary investigation by Metrolink indicated that the signal was functioning properly.)

As the NTSB completes its investigation, we will be able to add more detail to this map and remove potential causes that have been shown by investigation to be inappropriate.  As with any investigation the level of detail in the root cause analysis is based on the impact of the incident on the organization’s overall goals.

On February 22nd, 2003, a patient at Duke University Medical Center died after receiving her second heart-lung transplant.  The first transplant she received was rejected by her body due to a blood type incompatibility (she was Type O, the organs were Type A).  The loss of her life was tragic enough, but it was compounded by the fact that the two rare heart-lung block donations she received could have saved the lives of others as well.

We can perform a thorough root cause analysis built as a Cause Map that can capture all of the causes in a simple, intuitive format that fits on one page.  Download this one-page document to see the midlevel Cause Map and write-up.  The death of a patient was an impact to the hospital’s patient safety goal.  The loss of the organs was an impact to the patient services goal. 

The mismatched blood type organs were transplanted because the procuring surgeon (sent to pick up the organs) was not told of the blood type, so he could not perform an effective blood matching.  Donor services offered organs with the incorrect blood type because they didn’t ask what that was, possibly because the surgeon had specifically asked for the organs for this patient, and they assumed that a surgeon wouldn’t ask unless the blood type was correct.  The surgeon didn’t verify the blood type of the organs because he assumed that donor services wouldn’t offer an organ of the wrong blood type (which is normally the case, per their regulations).  The mismatch was discovered in the laboratory, but not until too late in the procedure, because the surgery must begin while the organs are en-route, due to limited viability of the organs.

This tragic incident demonstrates the problem in making assumptions, and it shows us some areas where transplant safety can be improved.  Although this was a very rare case, both hospitals and the donor services are making improvements to their systems to ensure this never happens again.

The Hubble Space Telescope was launched on April 24, 1990.  Once in orbit, it was quickly discovered that the images from Hubble were blurred.  An investigation into the issue revealed that Hubble’s primary mirror was not built to specification and couldn’t properly focus the light.  Specifically, the mirror was flattened too much away from the center and caused the light reflected from the edge of the mirror to focus on a slightly different location than the light reflected from the center.   The primary mirror in Hubble was only off specification by 2.3 micrometers, but the result to the $1.5 billion dollar project was disastrous. 

Solving Hubble’s focus issues was no small feat.  How do you repair a mirror that can’t be replaced on orbit when it is cost prohibitive to bring it back to earth for repair?  The answer was to modify the lens (which met specifications) to work with the off specification mirror.  COSTAR (Corrective Optics Space Telescope Axial Replacement) was added to Hubble during the first servicing mission in December 1993.  COSTAR is essentially eyeglasses for Hubble, additional lens built with the same error as the mirror, but in the opposite direction so that the effects of the off specification mirror shape are canceled out.  With the addition of COSTAR, Hubble met original design goals.

The primary mirror was constructed with a flaw because the tool, called a null corrector, used to create the template to guide the shaping of the mirror was itself flawed.  Null correctors use precisely located mirrors and lens to determine the shape of a mirror.  In order to assemble null correctors, reflected light is used to measure the distance between the mirror and the lens inside the tool.  When the null corrector used to shape the Hubble’s primary mirror was assembled a measurement error was made.  A small amount of reflective coating had fallen off an internal piece of the instrument and the laser used to perform the measurement reflected off the wrong location, resulting in a lens being 1.3 mm to far from the mirror.  Null correctors are extremely precise and do not change once assembled so the Hubble team used a single instrument to guide the mirror shape.  A single flawed tool and inadequate quality controls resulted in a flawed mirror.

 A visual representation of the root cause analysis has been created as a Cause Map that can be downloaded.

On May 22, 2008, Menu Foods and other pet food manufacturers agreed to a settlement on the class action lawsuit resulting from last year’s pet food contamination.  As part of the settlement, they will set up a $24 million fund to reimburse owners for expenses relating to pet deaths or injuries, screenings, and as compensation for food purchases.  This is in addition to $8 million that has already been paid to owners.  Also, they are required to screen for melamine, which owners say they are already doing.

The pet food manufacturers are bearing the brunt of the expense relating to the contamination issue.  But a root cause analysis shows that a significant portion of the blame lies in the regulatory process and dishonest raw material suppliers.  After all, the pet food manufacturers made pet food using raw materials that had been certified as meeting their requirements (which called for no foreign material contamination) and had not been flagged by the FDA. 

It has become increasingly clear that the FDA is not able to properly due its job in the increasingly global nature of U.S. foods and drugs.  The contaminated heparin found earlier this year shows that changes are too slow being made.  And, there is new evidence that private laboratory testing companies in the United States do the bidding of foreign importers who hire them, not the FDA.  These labs have stated that testing results for food entering the United States, no matter what kind of contamination they show, belong to the company.  This means that the results may only be released to the FDA once the company desires – or once a positive result has been obtained – no matter how many rounds of testing that requires.  Some labs have also claimed that importers “lab shop” – sending samples to lab after lab until they get the result they want.  Labs are not required to submit samples to the FDA.  So, the FDA may be in the dark about companies that repeatedly have contamination in their food products.

Dr. David Acheson, the FDA’s assistant commissioner for food protection supports congressional proposals that private labs be accredited by the FDA.  Hopefully action will be taken soon, before more tragedies occur.

On June 15, 1904, a church group headed out for an excursion through New York City’s East River on the Steamship General Slocum.  Approximately half an hour after the ship left the pier, it caught fire.  Despite being only hundreds of yards from shore, the Captain continued to go full speed ahead in hopes of beaching at North Brother Island, where a hospital was located.  This served to fan the flames quickly over the entire highly flammable ship, killing many in the inferno.  Most of those who were not killed by the fire drowned, even though the Captain did successfully beach the ship at North Brother Island, due to the depth of the water and lack of safety equipment.

To perform a root cause analysis of the General Slocum tragedy, we can use a cause map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  First we look at the impact to the goals.  On the General Slocum there were at least 1,021 fatalities of the passengers and crew that were aboard.  (However, only two of the crew were killed.)  There were other goals that were affected but the magnitude of the loss of life makes any other goals less significant.  The deaths and injuries were the impact to the safety goals.

Passengers drowned because they were in water over their heads with inadequate help or safety equipment.  Passengers were either in the water because they fell when the deck collapsed, or because they jumped into the water trying to avoid the fire.  The water was too deep to stand because only the bow was in shallow water and the passengers could not reach the bow.  This was due to a poor decision on the Master’s part (namely his decision to beach the ship at a severe angle, with the bow in towards the island, instead of parallel to the island, where passengers would have been able to wade to shore.)  Note that the Master himself (and most of the crew) were on the bow side of the ship and were able to (and did) jump off and wade to shore.  The safety equipment, including life preservers, life boats, and life rafts, was mostly unusable due to inadequate upkeep and inadequate inspections.

Passengers (and two crewmembers) were also killed by fire.  Once the fire was started, it spread rapidly and was not put out.    The fire spread rapidly because the ship was highly flammable.  When this ship was constructed, there was no consideration of flammability.  Additionally, the current of air created by the vessel speeding ahead drove the fire across the ship.  The fact that an experienced Master would have allowed this situation was considered misconduct, negligence and inattention to duty – the charges for which the Master was later convicted.   The fire was not put out because of inadequate crew effort and insufficient fire-fighting equipment.  The crew effort was inadequate of a lack of training.  The fire-fighting equipment was insufficient because of inadequate upkeep and inadequate inspections.  (Possibly you are noticing a theme here?)

Although many people have not heard of the General Slocum tragedy, many of its lessons learned have been implemented to make ship travel safer today, although many of the solutions were not implemented widely enough or in time to prevent the Titanic disaster from occurring eight years later.  (Although there were actually more people killed on the General Slocum, it is believed that the Titanic disaster is more well known because the passengers on Titanic were wealthy, as opposed to the working class passengers on General Slocum.  It is also surmised that sympathy for the highly German population aboard General Slocum was diminished as World War I began.)

In a macabre ending to a gruesome story, ships began replacing their outdated, decrepit life preservers after the investigation on General Slocum.  It was later found that the company selling these new life preservers had hidden iron bars within the buoyant material, in a dastardly attempt to raise their apparent weight.  Unfortunately there were no adequate laws (then) against selling defective life-saving equipment.

A study recently published by the Journal of the American Medical Association presented a review of clinical trials of hemoglobin-based blood substitutes.  This study showed that the clinical trials resulted in increased risk of heart attack and death for the patients being studied with no clinical benefit. 

We will examine this issue using the Cause Mapping process.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

In clinical trials one of the overall goals is to have zero injuries. The blood substitute trials led to a 30% increased risk of death, and a 2.7-fold increase in heart attack, causing increased risk with no clinical benefit.  The two goals that are impacted in the blood substitute example are the safety goal and the customer service goal.

In this example all of our impacts to the goals are caused by the increased risk of heart attack (myocardial infarction).  Additionally, there was no clinical benefit shown because the use of blood substitutes did not limit blood transfusions. 

Why was there an increased risk of heart attack?  The increased risk of heart attack is caused by decreased blood flow, which is caused by blood vessel contraction (vasoconstriction).  This occurs because nitric oxide is responsible for blood dilation, hemoglobin molecules scavenge nitric oxide, and a patient receives an infusion of hemoglobin.

The patient receives an infusion of hemoglobin because the patients are unaware of the risk, and because of ongoing clinical trials of hemoglobin-based blood substitutes.  These trials are ongoing because hemoglobin-based blood substitutes have been developed and because clinical trials are being performed.

The hemoglobin-based blood substitutes have been developed because blood substitutes are being developed and most of the blood substitutes are hemoglobin-based, because hemoglobin is seen as the most promising substitute.  The blood substitutes are being developed because they would be better in remote areas or for portability, to help deal with the shortage of blood, and to reduce problems from blood transfusions.

The clinical trials were performed because they were approved by the FDA;  there was no checking by scientists, review boards, or the public; and the companies continued clinical trials.  There was no checking, and the companies continued the trials, because there was a lack of information available.

The FDA and the blood companies are still trying to figure out how to go forward based on these new results.  Because of the potential usefulness of blood substitutes, especially in military applications, it’s likely we’ll continue to see progress on this issue.

On March 7, 2002, during refueling, a cavity measuring approximately 4 x 6 inches was discovered that had completely eaten through the more than 6″ thick reactor pressure vessel head of Unit #1 reactor at Davis-Besse Nuclear Power Station.  Fortunately, the thin stainless steel cladding layer had held the reactor pressure, although it was not designed to do so.  The loss of the vessel head was also a loss of a principal fission product barrier (one of the three responsible for ensuring radiaoctive fission products remain within the pressure boundary).  This was an impact to the safety goal.  The loss of a principal fission product barrier is also considered a “significant precursor to core damage” by the NRC, which is another impact to the safety goals.  All told, the cavity resulted in nearly $300 million worth in repairs and upgrades, and a two-year closure of the plant, during electricty production at Davis-Besse was severely reduced.  These were impacts to the material, production, and customer service goals. 

Let’s examine a high level root cause analysis and review some of the causes of the cavity.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The cavity was caused by continued boric acid corrosion.  The corrosion occurred when leaking coolant evaporated into boric acid.  This occurred because of a through-wall crack in a nozzle caused by primary water stress corrosion cracking that was undetected.  The corrosion also occured because the leakage was undetected, due to delayed inspections and an ineffective leakage detection methods. 

The boric acid was not removed because it was not viewed as a safety concern.

The corrosion occurred due to inadequate corrosion control, where the corrosion was not detected because of a lack of a full inspection of the head,  and because early signs of corrosion were ignored, or missed.  The oil corrosion products were not completely removed, because they were difficult to remove and their removal was on a “best-effort” basis.  Additionally, the control was inadequate because the rate was higher than expected.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the root cause analysis is based on the impact of the incident on the organization’s overall goals.

Sir Geoffrey de Havilland built the first commercial jet that reached production, the Comet.  The Comet design was finalized in 1945, as the British aircraft industry was attempting to establish a commercial aircraft industry post-World War II.  Prior to 1954, there had been some problems (a collision at take-off and a mid-air breakup) and some fixes to the hydraulic control system.  Then, on January 10, 1954 a Comet broke up in mid-air.  Flights were temporarily voluntarily suspended, then resumed.  On April 8, 1954, another Comet broke up in air.  (Both flights were taking off from Rome.)  The lives of 56 passengers and crew were lost in these two incidents, as well as two planes.  Additionally, the prestige of the British aviation industry suffered a blow.  (I’ll consider the lost prestige of British aviation a customer service impact.)

Let’s look at this incident in a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  Although there were two separate plane breakups, the Cause Maps are the same (based on the analysis and investigation performed after the accidents).  Essentially, the two planes were lost due to a structural failure of the cabin, caused by fatigue growth of a crack beyond the critical crack length (in essence, the crack length at which crack propagation is so rapid as to be uncontrollable). 

The fatigue cracking of the cabin occurred because the actual pressure cycles exerted on the cabin were more than the allowable (or where cracking would occur).  This was because the allowable pressure cycles were miscalculated.  The allowable pressure cycles were miscalculated for several reasons.  First, the inadequate test program.  There was no prototype, and the fatigue tests were misleading.  One test used a section that was effectively pre-conditioned, extending its life.  In another test, the section tested was so small that the test results were influenced by boundary conditions.

Next, the actual stress was above the predicted stress.  This occurred because 1) the square shaped windows caused pressure stresses to be distributed unevenly and 2) because the actual stress increased in localized areas.  The local stress at rivet holes is far above general stress (usually along the order of three times general stress) and two rows of rivets were used to attach the window frame.

While the comet was being developed, there was a general lack of knowledge about fatigue.  Many designers (de Havilland included) thought that fatigue was associated with vibration, which did not affect jet engines.  Additionally, the spread in fatigue results is large (some experts quote as high as 9:1), meaning that one plane could fail nine times faster (or more slowly) than another.  You can see how this is a problem with a small test sample.

A last problem was that the design of the Comet stretched the bounds of experience.  The comet was designed to fly at twice the speed of other airliners, at twice the height, and at twice the cabin pressure (for passenger comfort).  As such, the design was a great extension of the existing body of knowledge in not just one, but three dimensions.

Probably the most important lesson to come from the de Havilland Comet accidents is the importance of proper testing.  Once the cause was discovered, the Comet was redesigned and flew successfully, although by then Boeing had mostly taken over the market share.  It’s tragic that these accidents had to occur before the problem was solved.

Brooklyn Bridge marks its 125th birthday on May 24, 2008.  When performing a root cause analysis it is easy to spend a large amount of time focused on failures, but today engineers should take a moment to appreciate the accomplishment of this truly amazing feat.  The bridge has been refurbished many times, but the towers, main cables, and main beams are original and are now 125 years old.

At the time the Brooklyn Bridge was constructed the 6,000 ft long bridge was roughly six times as long as the longest bridge of the type that had previously been built.  The Brooklyn Bridge is one of the nation’s oldest and most treasured suspension bridges.  It has shaped the development of New York City.  At the time it was constructed Brooklyn was largely rural and the bridge helped sparked a growth spurt that dramatically changed the face of Brooklyn.  Brooklyn’s population grew by 42 percent between 1880 and 1890.  At last count in 2006, the bridge carried 126,000 cars per day.

Recent inspections have revealed some deterioration of the bridge, primarily with the newer approach ramps.  In a recent survey, state inspections ranked its condition as “poor”.  New York City plans to spend $250 million to 300 million to fix and repaint the bridge.  Hopefully these updates will return the bridge to good condition and it will continue to safely serve the citizen of New York City for many decades to come.

Slips, trips and falls happen every day.  Falls are responsible for tens of thousands of deaths each year.  (Slips and trips are considered a subset of falls, and are included in these numbers.)  Falls on the job account for 12-15% of all worker’s comp costs.  The direct and indirect costs of workers injured and killed on the job are estimated to be billions of dollars each year, both in worker’s comp claims and in lost productivity.  In 1999, as an example, 5,100 workers were killed by falls and over 570,000 injuries were reported.  However, there are many things that can be done to prevent and lessen the impact of falls.  Creating a Cause Map – a visual root cause analysis – will allow us to identify all the potential causes of falls.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  Once we’ve done that, we can identify the best solutions.

A worker is injured during a fall because the worker strikes the floor, or another object, and the object contacted is hard, and the worker hits in a way that causes injury.  When I say that workers are injured because they hit an object in a way that causes injury, what I am really talking about is factors that worsen a fall, and make injury more likely. The worker could land on a part of his or her body that is more easily injured.  Another way that injuries can be worsened is if a worker falls farther than his or her height (i.e., not a same-level fall).

The worker strikes the floor or other object because he or she falls, and there is no other support for the body, such as a handrail, or a harness.   There are four different ways to fall: slips, trips, the “step and fall” – where a person gets off-balance while stepping – and becoming unbalanced on moving equipment.

A worker slips when there is inadequate traction, either because the force of stepping off is too high, or the coefficient of friction is too low.  The force of stepping off can be higher than average if the worker is walking quickly or running, making a sudden change in direction, or if he or she has an awkward gait, from injury or old age, for example.  The coefficient of friction is a function of the traction provided by the shoes the worker is wearing and the “slipperiness” of the walking surface.  The coefficient of friction is too low if the traction of the worker’s shoes is inadequate and if the floor is slippery, because the surface is wet, icy and/or oily and does not have a non-skid coating.  Of course, for this to be an issue at all, the worker has to step into the slippery area. 

A worker can become off-balance by encountering an unexpected height difference (known as the “step and fall”).  This occurs in one of two ways.  Either the front foot lands on a surface lower than expected, or the ankle turns due to one side of the foot ending up higher than the other side, with footwear that inadequately supports the ankle.  These are both due to an unexpected height difference.

When a worker trips, it is because his or her toe is stopped, but his or her upper body is not stopped.  The upper body is moving because the worker is moving and he toe is topped because it encounters an object in the walking path, a rise in the walking path, or a difference in height of subsequent stairs. 

Last but not least, falls can be caused by workers who become unbalanced on moving equipment.  For this to occur, the worker must be inadequately secured to the equipment while the equipment changes motion, either by turning, decelerating or stopping, or accelerating or starting to move.

Once we have finished our Cause Map and found all the potential causes, we can assign potential solutions to all appropriate causes.  The solutions that I have come up with are in green boxes, near the cause(s) they “solve”.   You can see that some of the solutions are the responsibility of the company, and some are the responsibility of the worker, and some are both.   Although many of the responsibilties lie with the worker, it is in a company’s best interest to provide training on how to prevent, manage and mitigate falls.  Falls may seem like everyday, ordinary minor occurences.  While falls are everyday occurences, the consequences can be anything but minor.

The attached PDF document shows the visual root cause analysis as a Cause Map.

The only fatal reactor accident in the United States occurred on January 3, 1961, when an Army prototype known as SL-1 (for stationary, low power reactor, unit 1) exploded, killing the 3 operators who were present.  We’ll use the SL-1 tragedy as an example of how the Cause Mapping process can be applied to a specific incident.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The SL-1 tragedy killed the three operators present, which is an impact to the safety goal.  Another goal is that there be no damage to the vessel. In the case of SL-1, the  vessel sustained extensive damage.

The loss of life and vessel damage were both caused by the reactor exploding.  The reactor exploded because it went prompt critical (an uncontrollable, exponentially increasing fission reaction).  The reactor went prompt critical because withdrawal of the central rod can cause prompt criticality and because the rod was rapidly, manually lifted 26.4″ out of the core.

Withdrawal of the central rod can cause prompt criticality due to a lack of shutdown margin in the core, and inadequate safety criteria.

Because most of the evidence was so effectively destroyed, nobody really knows why the control rod was lifted out of the core.  There are two theories (disregarding the bizarre and improbable murder/suicide theory): 1) the control rod got stuck while being lifted to be attached to the drive mechanism, and, as the operator was exerting greater force on it, suddenly came free, resulting in a lift far greater than intended, or that an rod drop testing/exercising was performed improperly.

The control rod was stuck, and came free while being attached because it was required to be lifted 4″ out of the core and because control rods had been sticking.  The control rods had been sticking for one or more of the following reasons: 1) reduced clearances due to radiation damage (which can cause structural material to swell), 2) the passage was blocked due to loss of poison strips in the channel, caused by poor design and inadequate testing, or 3) lifting equipment not working properly due to inadequate lifting capacity of the lifting equipment.

Exercising/testing was potentially improperly performed.  This could have occurred because the operators chose to exercise/test the rods, attempting to ensure that they would perform properly, and because they didn’t realize what would happen. This is because of inadequate training and inadequate work instructions.  The testing was also potentially done improperly due to inadequate work instructions.

On a positive note, the SL-1 incident did initiate some positive changes in the nuclear industry.  Most notably, reactor design has improved and incorporated a “one-rod stuck” criteria which specifies that a reactor can NOT go critical by the removal of any one control rod.  Additionally, procedures and training have gotten more intense and more formal, and planning for emergencies has increased.

The attached pdf gives a visual representation of the intermediate level root cause analysis, the Cause Map.  It can be printed out to fit on one page.

About 1:40 am on May 17, six rail cars derailed and overturned near Lafayette, Louisiana.  One of the cars was damaged and leaked about 11,000 gallons of hydrochloric acid.  Authorities evaluated people with 1 mile of the accident.  Approximately 3,000 people were affected, including a few small businesses and a nursing home.  Five people, including two rail workers, were sent to a hospital and treated for eye and skin irritation.  All affect people are being reimbursed for food and hotel costs by the railway company that operated the train, BNSF Railway.

 The was potential for farther release of chemicals because one of other rail cars involved in the accident carried ethylene oxide, a flammable and dangerous chemical, and two of the remaining cars also carried hydrochloric acid. 

The Louisiana State Police’s hazardous materials unit is overseeing clean-up of the accident sit.  The spill is being neutralized with lime and the contaminated material will be removed and disposed of.  The rail car containing ethylene oxide was removed from the site as quickly to remove the potential for additional problems.

The cause of the derailment is not known at this time.  The Federal Railroad Administration will conduct an investigation of the accident.

The attached PDF file contains an intermediate level root cause analysis of the train derailment.  It was built using the facts that were available in media reports on the accident.  As more details are known, the Cause Map can be expanded.

In 2006, a British Petroleum (BP) worker in Prudhoe Bay, Alaska discovered a leak in its transit, or feeder pipelines (which deliver the crude oil drilled by BP to the main Trans-Alaskan Pipeline, which transports the oil to Valdez, in the southern part of Alaska.  The oil is taken from there in ships to the lower 48.)  Approximately 5,000 barrels (more than 200,000 gallons) of oil were spilled, adversely affecting almost 2 acres of permafrost (continually frozen soil).  During inspections performed as a result of the spill, severe corrosion (and another, smaller spill) was discovered in 16 miles of pipeline.  BP decided to replace all 16 miles of affected pipeline, at a cost of $260 million.  Additionally, BP paid $20 million in fines, restitution to the State of Alaska, and a payment for environmental research.  Some people believe this is the largest fine ever paid in the state for what was legally considered an “environmental misdemeanor.”

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  First we will look at the impact to the goals.  For the BP pipeline the environmental goal was impacted because 5,000 barrels of crude oil spilled, which affect on 1.9 acres of permafrost.  The impact on the two environmental goals was caused by the leak of crude oil.   The customer service goal was impact due to an increase in oil prices to consumers.  This occurred because  of the loss of barrels during the production shutdown, which is an impact to our production goal.  The loss of oil is due to the shutdown, which occurred in order to replace the affected lines, which is also an impact to the material goals.  The lines had to be replaced because a loss of pipe integrity was discovered, which led to the fine and restitution, which is also an impact to the material goal.

The loss of pipe integrity was due to severe corrosion product buildup.  The corrosion product buildup also resulted in a hole in the pipeline, which caused the leak.

The permafrost that was affected by the oil because of the leak, but also because the leak was not contained promptly. The next question is “Why was the leak not contained promptly?”  (And also, “Why did the leak occur?” which was due to a hole, but we’ll get to that later.)  The leak was not contained promptly because the the leaked oil was not visible, the location of the leak was inaccessible, and the leak detection program was ineffective. 

The severe corrosion product buildup resulted from three things.  First, there was corrosion in the pipe.  Second, the corrosion went undetected (we’ll go into both of these in more detail).  And third, the pipes were used beyond their design life (25 years vs. the 29 years they had been in service.

There was corrosion in the pipes because there were microbes in the pipe protected by a layer of sediment, and microbes produce corrosive substances (this is known as internal microbiological corrosion).  This layer of sediment was due to an ineffective maintenance program.  It settled to the bottom of the pipe because there were low spots in the pipe, and because the velocity of the oil was too low to remove sediment because the pipe diameter was too large.

The corrosion went undetected because of an ineffective inspection program.  The inspection progrm was ineffective because there was not a regular internal inspection schedule.  The ultrasonic testing used was not effective because it did not cover 100% of the line and the damage was very localized (thus the ultrasonic testing was missing the spots with the worst corrosion).  Additionally, a “smart pig”, which is used internally to measure the wall thickness of a line, was never run through the line, because BP did not believe it was necessary as they performed ultrasonic testing.

Once the Cause Map is built to a sufficient level of detail with supporting evidence the solutions step can be started. The Cause Map is used as a visual root cause analysis to identify all the possible solutions for given issue so that the best solutions can be selected. On the Cause Map you can see some solutions derived from the causes (in the green boxes).  Looking through news reports or BP press releases regarding their Prudhoe Bay pipeline, you’ll see that almost all of the actions listed have been or are being taken to prevent this problem from happening again.

On March 15, 2007, the Food and Drug Adminstration (FDA) was notified that ten animals had died from eating pet food.   This began an investigation into a problem that would result in the recall of 150 brands of pet food, and would kill many animals – some veterinarians suggest up to 1,000.  We can illustrate what happened in a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. 

First, we examine the impacts to the goals.  For a food manufacturer, one of the overall goals is to have zero injuries.  Some veterinarians suggest that up to 1,000 dogs and cats were killed in the U.S.  One of the other goals impacted is the customer service goal. In the case of the contaminated pet food, 150 brands (with 60 million containers of Menu Foods pet food, the most affected brand) were recalled.  This was the largest recall in FDA history, and was estimated to cost Menu Foods $54 million.

The loss of pets was caused by renal failure.  The renal failure in dogs and cats occurred because the dogs and cats ate contaminated pet food.  The dogs and cats ate contaminated pet food because it was in the food supply.  This also led to the recall.

Why was the contaminated pet food in the food supply?  The food was contaminated with up to 6% melamine and cyanuric acid (CA), and the contaminants were not detected.  The melamine and cyanuric acid (CA) were found in the food because they were added to the raw ingredients to increase the apparent content of the wheat gluten.  This reduced the cost for the manufacturer because melamine and cyanuric acid are cheaper than wheat gluten.  It increased the apparent protein content because melamine and cyanuric acid mimic the protein response in protein testing. 

The contaminants were not detected because standard tests did not detect them, and because of inadequate insepctions and inaccurate paperwork.  Standard tests did not detect the contaminants because melamine and cyanuric acid mimic protein response in protein testing, and because they were not tested for.  Inspections were inadequate because the material did not receive export inspections in China, because the exports were improperly labeled as non-food, and only food items are subject to mandatory inspection.  The inspections were also inadequate because FDA officials do not have ready access to Chinese plants because there is no binding agreement between China and the FDA.  The paperwork was inaccurate because the broker certified that the material specification was met, and the material specification forbid foreign material.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the root cause analysis is based on the impact of the incident on the organization’s overall goals.  See the attached pdf for a visual representation of the cause and effect relationships.

Early in March 2008, NASA announced that the shuttle mission to the Hubble telescope would take place in the fall rather than in August as originally scheduled.  A trip to Hubble is necessary to replace gyroscopes and batteries that failing.  Additionally, the mission will also be sued to install instruments that will increase the range of the telescope.   The changing schedule itself is not a cause for alarm, but the reasons between the slip are interesting.  The changing schedule shows that NASA is still struggling to recover from the tragic loss of the Columbia in many ways. 

The shuttle mission is delayed because new design fuel tanks will not be manufactured in time to support the original schedule.  In 2003, Columbia and her crew were lost when external foam fell off the fuel tank during ascent and struck the wing of the orbiter creating a plate size hole.  Initially, NASA managed the foam issue by modifying existing fuel tanks.  The last of these pre-existing fuel tanks will fly with Discovery when the shuttle launches for a space station assembly mission May 31.  The fuel tanks for future launches are being built with design modification to prevent foam loss.  This manufacturing process is taking four to five weeks longer than originally planned.  No information is available in media reports explaining why the manufacturing schedule is longer than expected.

The mission to the Hubble telescope is also the only shuttle mission planned that will not go to the international space station.  This fact is relevant because it means that two shuttles have to be prepared for launch, not just one.  Two shuttles means double the work needed to get the new fuel tanks ready for launch.  A second shuttle will be prepared in the event a rescue mission is needed. Trips to the space station are less risky because the astronauts could seek shelter in the space station if the orbiter was damaged, providing a much longer window for potential rescue.

The attached PDF file contains an intermediate level root cause analysis of the delay of the Hubble shuttle mission.  It was built using the facts that were available in media reports.  As more details are known, the Cause Map can be expanded.

On May 7, 2008, a sinkhole formed in Daisetta, Texas, near the Deloach Vacuum Compnay.  The sinkhole quickly grew to approximately 900′ x 600′ x 260′.  Fortunately, no one was injured.  But it did have a severe impact, both on the Deloach company and on the town. 

We can analyze this incident in a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page. 

The attached PDF document contains the detailed level of the Cause Map.  First, on the left we begin with the impact to the goals.  There were many goals impacted in this case: safety (possibility of injury); environment (a crude oil pipeline leaked and tankers and storage tanks fell into the sinkhole., which is also an impact to the material goal, because goods were lost); customer service (in this case, residents, who were affected by the main power line severed, the main street blocked off, and the potential of anevacuation; and production (Deloach Vacuum company shut down).

It is believed that the sinkhole occurred because of the collapse of a salt dome underneath the town.  The salt dome collapsed because a portion of the salt dome dissolved due to exposure to water.  It is believed that the exposure to water was from one or more of three possible sources.  The first is that it was the natural path of groundwater, due to geological features.  The second is that the water leaked through holes drilled through the surface, either wells or drill holes for salt water disposal or oil & gas production.  The third possibility is that salt water is injected underground dissolved part of the salt dome.  Salt water is injected underground because salt water is disposed in the dome (see above) and salt water waste exists because it is taken from crude oil.

Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the root cause analysis is based on the impact of the incident on the organization’s overall goals.

The investigation is continuing, as Texas officials try to figure out how to prevent further damage to the sinkhole.  For now, the expansion appears to be slowing down, and hopefully soon life can get back to normal in this Texas town.

Earlier this year, contamination of the U.S. supply of heparin was brought to light.  A significant portion of the U.S. supply of heparin was recalled, and the death toll potentially associated with the contamination has now climbed to 81, with hundreds of adverse events also reported.  Additionally, prior to the recall there was concern for deaths and injuries associated with the contaminated drug not fulfilling its expected purpose – preventing blood clots during surgeries and kidney dialysis – because the contaminant has no blood thinning properties.  So far, the contaminated drug has been found in 10 countries thus far, increasing concern about the drug supply chain.

Researchers have verified that the contaminant in the recalled heparin is oversulfated chondroitin sulfate (OSCS) and that they have discovered a mechanism by which the contaminant can cause the adverse effects (falling blood pressure and severe allergic reactions).  Additionally, the researchers have provided a test for regulators to screen heparin for this contaminant.  

They have determined that the OSCS was present at the active ingredient supplier plant in China.  Because OSCS does not occur in nature and mimics the chemical structure of heparin so closely, it is believed that the (mostly unregulated) crude heparin suppliers in China added OSCS to increase their profit, as OSCS is many times less expensive than heparin.  The OSCS was not detected by standard impurity tests, due to its similarity with heparin.  In Congressional hearings since the event, the Food and Drug Adminstration (FDA) has said that the inspections of the Chinese plant (as well as those of most foreign plants) were inadequate due to lack of funding for the FDA mission.

The attached pdf Cause Map shows that the heparin got into the drug supply after being placed in the raw ingredients.  It was not discovered by regulators, due to the lack of a commonly used, effective test.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  As more information is released about the failings of the supply chain in this instance, we can add more details to the cause map.

An Associated Press article, published on April 25, highlighted a common, often ignored problem of customers getting a different amount of gas then what they paid for.  Gas pumps contain a check valve that allows gas to start flowing at the same time the price meter starts.  As the check valves age, they can begin to hesitate and wait a period of time before gas flow begins.  This results in the consumer being overcharged because the price meter is turning before gas is flowing.    Worn check valves usually only cost consumers pennies per fill-up, but there have been instances of overcharges of 30 to 40 cents a gallon.  This issue doesn’t cost the consumer large amounts of money, but it adds frustration to a public already aggravated by record high gas prices.

To be fair, it should be mentioned that worn check valves sometimes help the consumer as well.  When a check valve hesitates at the end of a fill up, the price meter is stopped and a small amount of gas will continue to flow.  Also, to clarify, this isn’t a case of gas stations purposely gorging consumers.  It’s a situation where a common piece of machinery is wearing out and not functionally properly. 

To help prevent these types of errors, gas pumps are regularly inspected to ensure that consumers are charged for the correct amount of gas.  Regulations allow gas pumps to pass inspection if they overcharge by no more than 6 cents for every five gallons delivered.  Most states require gas pumps to be inspected every year to ensure accurate measurement of gas delivered.  Many counties try to inspect more frequently, but have difficultly because of staffing shortages and financial pressure.  

The attached PDF file contains an intermediate level root cause analysis of the worn check valves in gas pumps.  It was built using the facts that were available in media reports.  As more details are known, the Cause Map can be expanded.

On May 6th, 1937, the Hindenburg burst into flames over the Lakehurst, NJ Naval Base, after completing a successful trip across the Atlantic.  35 of the 97 passengers (and one of the ground crew) were killed.  The Hindenburg itself was a total loss, and the popularity of airships never recovered after the accident. 

The loss of 36 lives and the loss of the Hindenburg were both caused by the fire aboard. The loss of popularity of airships was caused by both the loss of the Hindenburg, and by the loss of lives.  The next question to ask is “Why did the fire occur?”

For the Hindenburg, this is where things start to get interesting.  There are three separate theories about why the fire started.  There are people who believe very strongly in each.   Luckily for us, the beauty of the Cause Map form of a root cause analysis is that we can use it even if we haven’t determined which theory is correct.

The first theory is that the fire started from sabotage.  Because the Hindenburg was frequently used as a Nazi propaganda tool, some thought it was almost too easy of a target for sabotage from anti-Nazi activists (who included in their number the designer of Hindenburg, Dr. Hugo Eckener.)  There was even a “suspicious” character who survived the crash, a German acrobat living in America.  However, eventually the FBI dismissed the idea of sabotage as a “red herring.” 

Another theory is that the fire began when static electricity ignited the flammable cover of the airship.  The major proponent of this theory, Dr. Addison Bain, has run tests on pieces of the Hindenburg cover preserved from the wreck site.  (This was not until 1994.)  He has also found supporting evidence from historic records of the Zeppelin company.

The other theory is that static electricity ignited a flammable hydrogen-oxygen mixture.  This was the original cause attributed to the disaster by the U.S. Department of Commerce’s root cause analysis investigation after the crash.  There are also people who claim that Dr. Bain’s theory is physically impossible, and do not specifically champion a cause, but treat this one as the most likely.

Note that we’re not espousing a theory – we are just recording all of the possibilities.  Once we have done that, the cause map allows us to find solutions for any potential causes.  Once we have all the theories mapped out, we can use the cause map as a resource to determine the solutions that are most helpful, or continue our root cause analysis investigation to determine which causes are most likely.

The attached pdf document gives an intermediate level Cause Map of the incident.

The Mars Climate Orbiter (MCO) was launched atop a Delta II launch vehicle on December 11, 1998.  Nine and a half months after launch, the MCO was scheduled to begin the process of establishing an orbit around Mars.  The plan was to use a technique called aerobraking to reduce the MCO velocity and slowly move the MCO from a 14 hour orbit to a 2 hour orbit.  On September 23, the $125 million dollar MCO was lost during the attempt to establish orbit around Mars.  Investigation into the accident revealed that the orbiter had entered the Martian atmosphere traveling too quickly with too low a trajectory.  The heat produced by friction from hitting the thicker atmosphere present at the lower trajectory at high velocity destroyed the orbiter.  The loss of the MCO cost NASA more than the $125 million dollars spent building the MCO.  In addition, NASA lost a substantial amount of time, lost all potentially gathered data, and lost some of the public support for the NASA program.

NASA investigation revealed many causes of the loss of the orbiter.  One of the most obvious causes is a unit error in the software used to help predict the velocity of the MCO, which in turn is used to predict the trajectory the MCO would enter Martian atmosphere. A little background is needed to understand how an error in the software causes errors in the predicted velocity.   Software called “Small Forces” is used to predict how the MCO’s velocity changed after a angular momentum desturation maneuver.  A angular momentum desturation maneuver is performed when one of the momentum wheels used to help the orbiter maintain orientation in space starts spinning too quickly.  During an angular momentum desturation maneuver, a wheel is deliberately slowed down (which would normally turn the spacecraft) while at the same time a jet is fired to counteract this force and keep the orientation relatively constant.  This whole process affects the speed the spacecraft is traveling and affects the trajectory of entry in the Mars atmosphere.  The error in Small Forces was simple one.  The results were in pound force and the program that predicted velocity expected them to be in Newtons.

The attached PDF file contains an intermediate level root cause analysis of the loss of the MCO.  It was built using  facts from media reports and the NASA investigation reports. The map can be expanded using all the known data to create a detailed Cause Map.

The Food & Drug Adminstration (FDA) recently reviewed adverse events related to heparin, which has been the subject of much scrutiny after 19 deaths were reported due to allergic reactions from contaminated vials.  Since January 2007, the FDA has received reports of 103 deaths from people taking heparin, 62 of which involved allergic reactions or hypotension (dangerously low blood pressure).  These deaths include people who were taking all brands of heparin, not just the brand affected by the contamination and recall.  The manufacturers of the brand that was contaminated and recalled says that they know of only 4 deaths assocciated with their contaminated product.  The FDA has stated that this does not mean that the deaths were necessarily caused by the allergic reactions and low blood pressure.  Although allergic reactions and low blood pressure were the cause of death of those who have died from the contaminated vials, it’s not clear that all 62 deaths are associated with contaminated heparin.    In fact, heparin carries a warning detailing risk of low blood pressure.  However, in the year 2006, only 55 deaths were reported from heparin, and only 3 were due to allergic reactions.  So there is obviously something that is increasing the number of allergic reactions to heparin.  Hopefully the increase in deaths is due to the contaminated heparin that has already been recalled from the market, but it’s possible that there are other issues, or other brands that are also contaminated.  The FDA continues to investigate, and hopefully can provide answers soon, especially to the people who depend on heparin for their well-being. 

See the previous Heparin blog for an intermediate level Cause Map of the Heparin Contamination issue (root cause analysis) as a downloadable pdf.

American Airlines resumed a normal flight schedule Saturday afternoon, ending a period of widespread flight cancellations.  Between April 8 and 12, 3,300 flights were canceled when all MD-80 jetliners in the American Airlines fleet were grounded.    More than a quarter of a million passengers were affected by the widespread flight cancellations.  As discussed in a previous blog, these drastic measures were taken when a large percentage of inspected MD-80s failed to meet FAA regulations on wiring from the airframe to a pump in the wheel well.  The wiring can be a fire hazard and affect power distribution. An intermediate level Cause Map showing the causes of the cancellations can be seen in the previous blog posted on April 10.

The cancellations may be over, but the effects will continue to linger.  The cost to the American Airline is estimated to be in the tens of millions of dollars.  In addition to lost revenue, American Airlines gave many inconvenienced passengers $500 travel vouchers and paid to put stranded travelers in hotels.  It is also difficult to put a financial cost on the huge amount of negative publicity that the airline has received as a result of these cancellations, but it is guaranteed to affect their business.  In addition to the financial burden of these cancellations, the entire airline industry is faced with raising fuel costs and this is going to put even more pressure on American Airlines.  Already, American Airlines announced on Friday (ironically on a day when nearly 600 flights were canceled) that it will be raising prices by as much as $30 a round trip tickets to help compensate for high fuel costs.  These dual blows to the bottom line are going to affect the health of the American Airline company for the foreseeable future.

It is also likely that many other airlines will be similarlly affected.  Doing a root cause analysis, it is clear that one of the causes of these cancellations is a new focus by the FAA on “zero tolerance” for any deviations from their detailed regulations.  As airlines struggle to understand the new inspection criteria, it is likely that other airlines will face cancellations.  The airline industry as a whole is facing some high hurdles in the upcoming months.  Four discount carriers have already declared bankruptcy in the last month and it is likely others will follow suit.  Even the established, traditional carriers are seeking changes to stay competitive.  For example, rumors are circulating about a possible Northwest and Delta merger.  This is going to be a turbulent time for Airlines and passengers.

Starting April 8, 2008, American Airlines grounded nearly half of its fleet when it pulled all 300 McDonell Douglas jets (MD-80s) from service.  At least 2,400 flights were canceled.  It is estimated that 100 passengers would have been on each of the canceled flights, bringing the total of affected passengers to nearly a quarter of a million people.  The MD-80s were grounded because 15 of 19 inspected aircraft failed FAA inspection this week.  The issue is with the installation of wiring connecting the airframe to a hydraulic pump in the wheel well.  The regulations are written to prevent rubbing and chafing of the wiring, which can lead to exposed wiring.  Exposed wiring is a concern because it can to power issues and shorts, and it is a potential fire hazard.

The most alarming part of the story is that American Airlines grounded these same planes for the exact same issue on March 26 and 27.  Over 350 flights were canceled while the planes were inspected and repaired if necessary to compile with the FAA wiring regulations.  All planes were back in service on March 28 after American Airlines asserted they satisfied the regulation.  Little information is available on what went wrong two weeks ago.   There are a number of questions that would need to be answered to perform a thorough investigation.  Are the FAA regulations confusing?  Do the AA mechanics need additional training?  Did the airline fail to internally check the wiring prior to putting the planes back into service?   If an inspection did occur, did the inspectors understand what they were looking for?   It may not be clear exactly what went wrong, but it is clear that something failed in the system to cause this second round of cancellations.

The attached PDF file contains an intermediate level root cause analysis of the cancellation of American Airline flights on April 8-9.  It was built using the facts that were available in media report.  There are many details still missing, that could be added as more details are known.

Just before 11 am on January 25, 2008, a fire started on the roof of the 32 story Monte Carlo Hotel in Las Vegas.  The fire spread quickly along the outside of the building, fueled by the highly flammable foam like material, Exterior Insulation Finishing System (EIFS), used to construct the hotel façade.  A spark from a hand held cutting torch being used on the roof of the hotel hit the EIFS and started the fire.  6,000 guests and workers were evacuated from the hotel.  The hotel remained closed until February 15.   Considering both the damage to the hotel and lost business, the total cost of the fire is approximately $100 million dollars.  Luckily, no major injuries resulted from the fire.

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  The Cause Map shows that the fire started because a spark from a hand held torch hit a flammable material.  The Cause Map can also be used to identify possible solutions that would prevent another fire.  In this case, two areas that would merit farther investigation would be the use of highly flammable material on buildings and the lack of protective measures taken to protect the EIFS from the sparks.  For example, there were no mats in place to protect the EIFS from being hit by sparks.  From the information available, it isn’t clear why no protective measures were taken to protect the EIFS, but it is known that the contractor failed to obtain the correct permit (which involves getting information on appropriate safety procedures). It is reported in an Associated Press article on the fire that Las Vegas city officials are currently evaluating whether restrictions should be placed on the use of EIFS.

The attached PDF file contains an intermediate level root cause analysis of the hotel fire.  It was built using the facts that were available in media reports on the fire.  As more details are known, the Cause Map can be expanded.

Heparin, which is widely used as an anticoagulant (blood thinner) has been in the news lately and the news is scary.  19 people have died, and 785 have experienced adverse reactions due to contaminated heparin.  The heparin in question has been found to contain up to 50% oversulfated chondroitin sulfate, which mimics heparin so closely it can not be distinguished in basic tests but provides no anticoagulant activity.  The adverse effects are caused by severe allergic reactions, including low blood pressure which can occasionally lead to fatal stroke.

Whether or not the chondroitin sulfate is to blame for the allergic reactions, it also has the potential to cause serious harm by negatively affecting the blood thinning properties of Heparin.  People who take heparin because they require its anticoagulant properties may have serious difficulties with a dose that is only 50% effective.  Because of these concerns, the Heparin in question is taken off the market.  But serious consumer concerns remain about the system that allowed the contamination to happen in the first place.  Due to the potential for fatal side effects, lots of heparin (the total amount is unclear) have been recalled from 6 countries (at last count).

A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  Click on the pdf document for a more detailed analysis.

Many organizations focus on trying to boil down their problems, even extremely complex ones, into the one “root cause”.  One of the problems with this is the overgeneralization that results.  This overgeneralization may allow organizations to feel that they are “off the hook” if, for example, the “root cause” ends up being “human error.”  Because human error is unavoidable, there may be no steps taken to prevent or mitigate further occurences.  Overgeneralization can also lead to a warped perspective of the problem in question, based on the desire to find the one true “root cause” of the event.  If you ask people what the cause of the EXXON VALDEZ oil spill was, many people will say that the Captain was drunk (overgeneralization of a complex issue into human error, specifically pointed at the man in charge).  However, not only was the Captain not present on the bridge at the time of the grounding which resulted in the oil spill, he was found not guilty of operating a vessel under the influence of alcohol. 

Another issue with attempting to find the “root cause” is all of the other contributing causes that will be missed.  This is especially important when the solution for the “root cause” is not 100% effective.  TWA Flight 800 went down for many reasons, but according to the National Transportation Safety Board, the airlines sole focus on preventing fuel tank explosions is preventing ignition energy from entering the tank.  However, that solution is not foolproof – ignition sources can be minimized but not entirely removed.  That is why some are turning their focus towards solutions for the other causes – namely the flammability of the fuel tanks and the presence of oxygen that would allow an explosion to occur.

So if finding the “root cause” isn’t the answer, what is?  Well, in order to effectively combat a problem, we have to find the best solution.  In order to find the best solution, we have to find all the solutions, and in order to find all the solutions, we have to find all the causes.  We do this by making a Cause Map, a visual root cause analysis.  This Cause Map asks “why” until all possible and contributing causes have been identified.  The next step is to identify any potential solutions for each cause.  Once all potential solutions have been found, an organization needs to determine which solution, or solutions, is best based on the severity of the issue, the effectiveness of the solution(s) and the availability of resources to implement the solution(s). 

Vytoria is a drug intended to improve heart disease.  There are already millions taking it, or one of its parts.  Full results of its trial were released Sunday, March 30th.  Although Vytorin successfully reduced three key risk factors, it did not improve heart disease, because it had no effect on reducing plaque.  The three risk factors improved by Vytorin, and thought to lead to plaque buildup, which leads to heart disease, were LDL (low-density lipoprotein, or bad cholesterol), triglycerides (a form of fat made in the blood), and  artery inflammation as measured by CRP (C-reactive protein, which is released into the blood due to inflammation).  So, if we look at the root cause analysis, we have:

But if this is our Cause Map, and we reduce all three causes, we should reduce the result – plaque formation, which should reduce the occurrence of heart disease.  If we end up with the results we have here, which is no effect on plaque buildup despite proof that the three causes (called “key risk factors” in the medical world) have been reduced, it means there’s a problem with our root cause analysis.  This particular analysis gets even more confusing.  Some drugs, like statins, lower LDL and successfully reduce heart disease.  This implies that the cause-and-effect relationship of LDL and heart disease is valid.  But there was a drug that is no longer being advanced that successfully reduced cholesterol, but actually raised heart risks.  What does all this mean?  It means back to the drawing board on our cause map.  I don’t pretend to have the answers – I don’t think anybody does, or there would be a new drug out there right now – but it means that as you’re reading this, the smart folks developing new drugs are donning their lab coats and trying to figure out what went wrong.

Root cause analysis can be a very effective technique to analyze a problem.  But what if the evidence trail goes cold?  Is creating a Cause Map still useful when unanswered questions remain after a thorough investigation?  The crash of a Comair jet in Lexington Kentucky on August 27, 2006 is a good example of this situation.  The plane crashed during takeoff, killing 49 people . The flight crew mistakenly attempted to takeoff on the wrong runway, which was too short for the plane to reach the necessary speed for lift off.  Even after a detailed investigation by the National Transportation and Safety Board, it still is not clear why the flight crew used the wrong runway.   As an aside, the pilot and the first officer were competent professionals from all accounts and there is no history of either making errors of this magnitude.

Plane crashes are unique in the fact that there is a lot of data available to investigators.  The cockpit voice recorder (CVR) records all conversations in the cockpit and the flight data recorder (FDR) records instrument readings.  Usually the reason behind plane crashes can be determined using all this data.  In this case, the information did provide some useful insight, but no clear reasons why the mistake occurred. 

Buillding a Cause Map of this accident does make one thing very clear.  There are many events that had to occur for this mistake to happen.  One of the causes of the plane crash is clearly the error on the part of the flight crew, but another cause is the failure of the traffic controller to catch and correct the error.   There were two separate windows of time where the controller had an opportunity to prevent the plane crash, but didn’t for a variety of reasons.

It’s tempting to say the plane crashed because the crew used the wrong runway and leave it at that. The main problem with this line of reasoning is that this conclusion doesn’t help prevent future crashes, especially since the error isn’t well understood.  If all the focus is placed on why the wrong runway was used, an opportunity to improve the process and prevent future accidents is lost.  In a case where there is missing information, building a cause map can be useful because it helps the investigation to explore all the causes and potential solutions.  Only one cause needs to be eliminated to prevent the accident. For instances, the crew could had lined up at the runway and the accident could have still been prevented if the controller had caught the mistake.  Focusing on a solution to eliminate the better understood causes provides a useful place to start.

Just after 4 a.m. on January 5th, 2008 about 600 homes began flooding in Fernley, Nevada, about 25 miles East of Reno.  A 50 foot section of a canal embankment failed flooding the adjacent area.  The 32-mile canal carried water from the Truckee River south to Fallon area farms.  There were no injuries in the flooding but it easily could have been very serious.  The complete estimates for repairing the canal and the homes are not available at this time.

A report issued by the U.S. Bureau of Reclamation released March 20th concluded that the century-old irrigation canal failed due to burrowing rodents.  A simple root cause analysis for this incident using the Cause Mapping method captures the tunneled holes in the embankment as one of the causes.  Another one of the causes is the increased water flow in the canal caused by the nearly 2 inches of rain that fell the day before.  The annual rainfall for the area is about 5 inches.

The Cause Map shows that the canal obviously failed because the stress on the embankment was greater than the strength of the embankment.  The increased water flow added to the stress on the embankment while the holes tunneled by the rodents reduced the strength.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

Since the canal is almost 100 years old tunneling muskrats are not a surprise.  If the holes would have been identified earlier and filled, the risk of the breach would have been reduced significantly.  The evidence that the inspection and maintenance of the canals was ineffective is the fact that the canal failed due to holes.  An effective inspection program would have found the holes and addressed them – that’s the purpose of inspection and maintenance.  Past inspections may have been conducted exactly as required, which simply means the previous inspection requirements were inadequate.  Ineffective inspections is one of the causes of the canal failure that would need to be investitgated further.

The attached PDF file contains an intermediate level root cause analysis of the canal failure.  It includes causes that were considered in the Bureau of Reclamation report as well as some of the evidence and solutions.  A more detailed Cause Map can be created from the specific information in the bureau’s report.

On Sunday morning, March 23rd, 2008, there was an explosion at the Cargill Meat Solutions plant in Booneville, Arkansas.  Thankfully no injuries have been reported, but 180 people were evacuated due to the ensuing ammonia leak.  Although not much is known about the causes of the explosion, we can do a very simple root cause analysis.

First, we analyze the impact to the goals.  Although there were no injuries, it was probably at least partially due to the fact that there were very few employees present at the plant.  So, the potential for injury (had this occurred during a busy working day) has to be taken into consideration as an impact to the safety goals.  A leak of any kind is an impact to an environmental goal.  An evacuation is an impact to a customer service goal (which I consider to also include community relations). 

The factory is currently closed, affecting our production goal.  And, there was extensive damage to the factory (the total amount yet to be determined), affecting our materials and labor goal.

We can begin by tracing some of these causes to the ammonia leak.  The evacuation and one cause for potential injuries is the ammonia leak, which itself was an impact to the goals.

What caused the ammonia leak?  Well, for any leak, the thing that is leaking must be present, and it must have a leak path.  In this case, the leak path was likely caused by the extensive damage to the building, which is another impact to the goals.

The extensive damage to the factory was caused by a fire that continued to burn.  It could not be put out by firefighters because of the presence of ammonia, which poses health risks.  Because the fire continues to burn, the factory has been closed, which is another impact to the goals.

In order to have a fire, fuel, heat and oyxgen are required.  Oxygen is present in the air.  Here, the heat was generated by the explosion (which is actually a type of rapidly igniting fire).  What fueled the fire is unclear, but it’s possible that it was the ammonia.

Because an explosion is a type of fire, it also requires fuel, heat and oxygen.  Again, the oxygen is from the air, and the fuel is unclear, but potentially ammonia.  What supplied the initial heat to start this disastrous chain reaction is also unclear, but there was welding going on at the time.  Thus, it’s possible that the welding was the heat source.

That’s about as far as we can go without further information, but if you look closely at all these partial root cause analyses, you’ll notice a theme.  “Ammonia present” connects to no fewer than four cause boxes, contributing to the explosion, the fire, the lack of firefighting capability and the evacuation.  This doesn’t mean that the answer is necessarily to stop using ammonia.  That may solve the problem, but there are times when hazardous chemicals are necessary to certain processes.  However, it does mean that if a single cause shows up frequently in our cause map that extra attention must be paid to it.  That is certainly the case with any hazardous chemicals, including ammonia. 

On Sunday March 23, a Ukrainian tug boat collided with a Chinese registered cargo ship.  The tug boat capsized and sunk in 115 feet of water, trapping 18 sailors inside the hull.  All 25 passengers on the cargo ship and seven passengers on the tugboat were rescued.  Experts believe the trapped sailors could still be alive if they were able to find air pockets inside the boat.  Unfortunately, no signal or sound coming from within the capsized ship has been detected during the 9 rescue attempts that have occurred so far.  Rescue efforts continue, but are hindered by low visibility and strong currents.

There is very little information currently available on how the collision happened. Even through the details are vague, it can be very useful to apply the root cause analysis method during this stage of an investigation.  Knowing some of the basic causes that have to be present for each type of incident can help direct the investigation efforts.  For example, if a fire occurs you already know that there was a spark, oxygen and fuel present and you can start the investigation by considering each of these causes. 

In the case of the tugboat collision, there are number of causes that had to be present for the collision to occur and they could be used as starting places for the investigation.  Beyond the really basic, like there had to be two ships present, there are a few facts that can be assumed from the beginning.  First, there are strict rules of the road that govern the path of ships, especially near land, similar to the laws that govern vehicle traffic.  Somebody didn’t follow the rules and if you can figure out who didn’t and why that will go a long way to explaining why the ships collided.  Second, every ship should have situational awareness and avoid other ships (even if that other ship is doing something strange) and both ships failed to keep their distance from the other ship.  Either this was a failure to properly monitor position or the methods used were inadequate.   In this specific case, from the damaged that both ships sustained,  I’d also be willing to bet that somebody was going to fast too close to shore. 

Each type of accident has fundamental causes that had to be present for it occur.  While many investigations lead far beyond the causes that can initially be assumed, they can be helpful place to start.  Performing a root cause analysis can help guide an investigation and ensure all the pertinent questions are asked and answered.

The mechanics behind the failure of the Tacoma Narrows Bridge were discussed in a previous blog entry.  There were many design issues with the bridge and the civil engineering community has done an excellent job of studying and incorporating lessons learned from the failure. But a question that may be more pertinent across all engineering disciplines is, “Why did the design process fail?” 

How did a bridge get built that would fail in a little over four months?  A root cause analysis of the bridge shows that factors that shaped the doomed bridge design are present in almost every engineering project.  There is as much to learn from the failed process that led to the design as there is from the failed design.

The primary factor that led to the bridge design was cost reduction.  The first design proposed for the Tacoma Narrows Bridge was a conventional suspension bridge that was estimated to cost $11 million.  Funding was an issue for the bridge from the beginning, and the design that was finally approved for the bridge was an elegant bridge with a narrow roadbed and short girders.  In additional to being more aesthetically pleasing, the estimated price tag of $8 million dollars was nicer to look at as well. Another contributing factor is the engineer behind the second design, a very well-known civil engineer Leon Moisseiff.  His credentials were impeccable, and he had previously consulted on the famed Golden Gate Bridge, the Bronx-Whitestone Bridge and others.  Additionally, he helped developed some of the methods used throughout the world to calculate forces in suspension bridges.

In a tale that is probably repeating somewhere right now, a cheaper, flashier design was recommended by a well respected engineer.  Nobody wanted to listen to the voices of dissension among the less well-know engineers (and there were engineers who spoke out against the new bridge design saying it was unsafe).  The project then dramatically fails.

As engineers, there is a lot we can learn from studying how past projects have balanced cost and safety.   There are stories where remarkable profits and success have been achieved by finding a cheaper way to do something.  But sometimes, as in the case of the Tacoma Narrows Bridge, the cheap way costs more in the end.
 

Unfortunately, an investigation into a deadly construction accident is currently underway in New York City.  On Saturday March 15, a 19 story crane collapsed.  Four construction workers were killed and 18 others were injured.  Emergency workers are still sorting through the rubble in an attempt to find any remaining survivors.   The crane was being used at a high-rise construction site and was attached to the side of a skyscraper.  Details as to why the crane fell are still vague, but eye witnesses report that a piece of steel fell and severed at least one tie that held the crane onto the building. Once the connection between the crane and the building was weakened, the crane toppled and split into two pieces.  As it fell, the crane smashed a 4 story townhouse and damaged parts of 3 other buildings.

What made the crane fall?  Part of doing a root cause analysis is sorting the pertinent facts from all the information that is available.  Is it relevant that neighbors had complained that the construction crews were working illegal hours and it seemed like the building was going up too quickly?  City officials had issued 13 violations to the construction project, which at first glance seems like a red flag indicating a lack of attention to safety.  But Mayor Bloomberg has said that this is a normal number of violations for a project this size.  Additionally, the crane had been inspected on the day before the accident and no violations were issued.  Did something change in 24 hours or was the inspection inadequate?  At the time the crane fell, it was being raised to enable work to begin on the next floor of the building.  Did this contribute to the accident?  Where did the piece of steel come from that supposedly fell?  At this point in the investigation there are more questions than answers.

There are many facts and theories that surface in the wake of any accident, and part of doing a root cause analysis is determining which are actually relevant.  This is a process that is much easier said than done.  The push to provide answers quickly can add to the pressure to produce a “cause” for the accident.  But as anyone familiar with the concept of root cause analysis knows, there isn’t a single “cause”, there are many causes that contributed to the accident.  The best approach is to record all possible causes and continue to gather evidence until you can eliminate all the noise and are left with the true causes.  Then the work of creating solutions that address the causes can begin.

The power of performing a root cause analysis of a problem can be demonstrated by working through well-known engineering disasters.  For example, creating a cause map for the failure of the Tacoma Narrows Bridge helps explain why the bridge collapsed and illustrates some of the lessons that can be learned. 

The original Tacoma Narrows Bridge was opened for traffic on July 1, 1940.  A little more than four months later, the bridge violently failed and a 600 foot span of roadbed fell into the river below.  Why did the bridge tear itself apart?  What made the bridge collapse on November 7th and not some previous day?  One of the first questions asked when performing a root cause analysis is, “What is different about this issue?”   The first difference to consider was that November 7th was a windy fall day.  Construction of the bridge ended in the summer so this was the first fall the new bridge had experienced.  On the day the bridge failed, the wind was blowing across the roadbed at 42 mph.  This was the strongest the wind had blown since the bridge was constructed.  The second difference was the design of the bridge itself.  The Tacoma Narrows Bridge was particularly narrow relative to its length, making the roadbed more flexible than other suspension bridges.  Additionally, the bridge had shallow girders and was relatively weak in torsion compared to other suspension bridges built around the same time.  The combination of fall winds and the slender bridge design resulted in the collapse of the bridge.

As the wind impacted the bridge, the force twisted the roadbed until it hit a point where it was constrained by the suspender cables, and then it twisted back in the other direction.  Other suspension bridges of the time experienced similar twisting motions, but what made this bridge different was that the amplitude of the motion increased with each cycle, rather than dying out.  The bridge was unable to dissipate the wind energy, and the motion of the bridge continued to grow until the twisting motion increased to the point where the suspender cables snapped and the roadbed was dropped into the river below.  The mathematical explanation of why the bridge collapsed is fairly complex, but simply put: the bridge was underdamped causing the twisting oscillations to increase rather than decrease with each twisting cycle.

Sadly, Joseph Juran died in New York on February 28, 2008 from natural causes.  He was an astounding 103 years old.  Dr. Juran coined the phrase “Pareto principle” after Vilifredo Pareto, an economist who noted that 20% of Italians held 80% of Italy’s wealth.  Dr. Juran applied this principle to quality, noting that 20% of causes are responsible for 80% of a problem. 

As such, it seems that this would make root cause analysis easier – find 20% of the causes, and we’re 80% done with the problem!  In practice, many root causes analyses just stop there.  However, Dr. Juran himself recognized this problem, and began referring to the causes as “the vital few and the useful many.”  He understood that there is still great value, and perhaps necessity, in determining 100% of causes, not just the “vital few” that are responsible for a disproportionate share of problems. 

Doing a visual root cause analysis, or cause map, can assist us in finding the “useful many”.  The map allows us to find 100% of the causes, not just those that are obvious or most responsible for the problem.  Because the technique effectively draws out these solutions, it ensures that we do not spend 80% of our time finding the most elusive 20% of causes!

Once we’ve found all the causes, we can then assign a solution to each cause.  At this point, your organization will prioritize the solutions using the Pareto principle.  Obviously in a world of limited resources, the solutions that should be applied first are those that can solve 80% of problems.  But it’s important that we ensure that all possible causes and all possible solutions are present in our root cause analysis.   To successfully achieve a goal of “zero defects” or “zero injuries”, we’ll have to apply solutions to all the causes. 

What happens when our root cause analysis of a problem leads to “operator tired” or “operator fell asleep”?  If we stop there, and blame the operator, we are missing an important opportunity to improve the safety of our organization, and potentially prevent another problem from occurring.

One of the causes of the EXXON VALDEZ oil spill is that the Third Mate who was actually manning the bridge was exhausted due to long work hours and too little sleep.  The collision of two metro trains in Washington D.C. in 2003 was caused by an operator who had worked a double shift, from 8 a.m. to 11 p.m., then returned the next day to do it again.  A few hours into his first shift, his train rolled backwards more than 2,000 feet into another train and caused millions of dollars worth of damage.  The investigation team determined that the brake had never been pressed. There have been some recent studies that show that people suffering from excessive sleep deprivation perform some tasks about as well as someone who is legally drunk.   Naturally, this is a concern for anyone operating heavy machinery or performing surgeries.  Yet rotating shift work, excessive work hours and too little time between shifts continue to occur . . . and sometimes have tragic consequences.

Based on these concerns, some organizations are trying to alleviate fatigue problems caused by their work standards.  For example, the Accreditation Council for Graduate Medical Education’s common duty hour standards took effect on July 1, 2003.  These standards reduce the number of hours medical residents can work in a week, and require adequate rest between duty periods.

When we end up with a cause on our root cause analysis of “operator tired” or “operator fell asleep”, it is essential that we continue to ask “Why?” to determine the factors that led to exhaustion.  Many times, regulations to ensure adequate rest before duty do not exist.  In some cases, company policy encourages or requires workload that does not allow for adequate sleep.  If we do not continue our root cause analysis to determine the reason that the operator is tired, we run the risk of having the same problem – or worse – happen again.

The Supreme Court has begun hearing Exxon Mobil Corp.’s appeal of punitive damages stemming from the 1989 oil spill caused by the grounding of the EXXON VALDEZ.   The punitive damages currently stand at $2.5 billion, reduced by appeals from the original punitive damages of $5 billion.  People across the country are eagerly awaiting the Supreme Court’s decision, which is expected in the summer, for many reasons.  While this case has several interesting legal ramifications, the one I’d like to focus on is Exxon Mobil Corp.’s liability, and how a root cause analysis can help us foresee the different areas where liability might be at issue.  When examining the causes of the EXXON VALDEZ spill, a very basic root cause analysis follows: 

What a lot of people imagine when they hear about the EXXON VALDEZ, and what the cause map above implies, is a drunken Captain haphazardly steering a gigantic oil tanker into a reef.  As is usually the case, the real issue is far more complicated.  Many people don’t realize that the Captain was not even present on the bridge when the ship struck the reef.  So his drinking did not directly cause the accident.  Yet the fact that he was drunk, which was against company regulations, is one of the main reasons that Exxon Mobil Corp. is being found liable for punitive damages.  The argument is that they knew the Captain had an alcohol problem and still allowed him to pilot the ship.  We’d have to expand upon the cause map above significantly before there was any mention of Exxon Mobil Corp. and their contribution (direct and indirect) to the spill.  A visual root cause analysis expanding upon the last two boxes is shown below.

This is why a visual form of the root cause analysis is so helpful.  Indirect causes are the easiest ones to miss, and they are frequently the biggest liability issues.  A detailed cause map allows us to see the indirect causes that can lead to liability issues – such Exxon Mobil Corp.’s inaction towards the Captain’s violation of company rules, which is part of the basis of Exxon Mobil Corp.’s liability in the ongoing litigation.  It’s only when we get down to the nitty-gritty of the root cause analysis that we can see the contributions from all the major players.  It will be interesting to see what kind of a price tag the Supreme Court will place on those contributions.

Have you ever heard anyone say “the procedure is a piece of junk?”  If you ask the person if every step of the 40-step procedure is wrong they will usually say “No, not every step.”  You can ask them to show you which step is wrong.  When they point out that step 14 is wrong, you can ask, “Is every word in step 14 wrong?”  They will usually say “Well, no, not every word, but that 5 is supposed to be a 7.  You can then say “I understand.  That is an issue.  Thanks for catching that.  I’ll get it updated.  These things have got to be clear and accurate.”

The original statement “the procedure is a piece of junk” is too general.  It refers to the procedure as one thing, not 40 things.  People that blame and complain speak in very general terms.  They group things together and generalize.  People that are very good at troubleshooting and solving problems naturally think and speak in very specific terms.  Analyzing a problem is about breaking a problem down into parts.  Analyzing problems is always about getting more specific so that very specific actions (the solutions) can be taken.

Terms like “human error”, “procedure not followed” and “training less than adequate” are used regularly by companies to explain why a particular problem occurred.  These terms are too general.  They inadvertently give the impression that the cause has been found during their root cause analysis.  Knowing that someone didn’t follow a procedure is important, but is not the end of an investigation.  We’re just getting to the good stuff.  We’re just getting the specific information that created the incident in the first place.

Our interest is not limited to fixing that person that didn’t follow that procedure.  We want to address how we developed, approved, utilized and updated this particular procedure so that the procedure process can be improved.  It’s about improving how we capture and communicate the best work practices in our organization as a whole.  This is the leverage within the organization.  To solve problems effectively be specific.  Ask those who blame and complain to help us understand the issue by being more specific.

For more information about improving the problem solving skills within your organization, visit ThinkReliability – specializing in Cause Mapping – Effective Root Cause Analysis training.

The Chemical Safety Board Investigations Manager, Stephen Selk, P.E. gave a briefing on February 17, 2008 to update to the public on the Imperial Sugar Company explosion and to provide a root cause analysis on dust explosions.  The speech was very enlightening.  One of the things he said was “The Board identified 281 [dust] fires and explosions over a 25-year period that took 119 lives and caused 718 injuries.”  So, obviously this is a concern.  But what to do about it?

When he presented the root cause analysis for dust explosions, he stated that five things were necessary for an explosion: presence of a combustible dust, presence of oxygen, dispersion of the dust into the air, confinement of the particles, and ignition energy.  For each of these requirements in the root cause analysis, there is a possible solution – but that possible solution may or may not be effective.

First, a dust explosion requires the presence of a combustible dust.  Unfortunately, the combustible dust is usually a by-product (or the actual product) of the process being performed.  The Imperial Sugar Company explosion was caused by sugar dust.  The Imperial Sugar Company refines sugar.  Sugar dust will always be present at a sugar refinery.  So, attempting to remove the combustible gas is probably not worthwhile.

What about the presence of oxygen?  Obviously, there has to be oxygen in the refinery itself for the workers to be able to breathe, but it may be possible to remove the oxygen within some of the equipment, possibly by the use of inerting equipment.  Inerting equipment using nitrogen to reduce the percentage of oxygen to below combustible levels has been used with some success in various industries and was recommended as a solution to the fuel tank explosion on TWA Flight 800.  The use of inerting equipment within processing equipment would help reduce explosions that are begun within the equipment.

I’d like to examine dispersion of the dust and confinement together.  These two requirements almost seem to be mutually exclusive.  After all, if the particles are dispersed, they aren’t being confined.  Likewise, if the particles are confined, how are they dispersed?  In reality, the particles are always confined, even if it is only by the building surrounding the processing plant.  It’s not clear how much confinement, or how much dispersion, is required for an explosion to occur.  It’s also likely dependent on the particular organic material that has become combustible dust.  So, specific solutions here would need to be tailored for each individual plant – and there may not be any that truly work.  However, there is one solution that may prevent, or lessen the effects of, follow-on explosions.  That is a blast-proof building.  In the type of blast-proof building I’m thinking of, there is a weaker section of the building that acts almost like a pressure-relief valve.  It blows out before the rest of the building and directs the explosion through a particular path.  (If the processing equipment involves hazardous materials, it could even direct it to another confined area to prevent environmental contamination.)  This solution, too, would need to be designed specifically for the task at hand, and may be prohibitively expensive.

Last, let’s focus on ignition energy.  Eliminating all sources of ignition energy in a plant seems like it would be possible, albeit complicated and possibly prohibitively expensive.  However, with greater thought, eliminating all ignition sources, including static electricity, in a plant filled with electronic equipment and wiring seems like a monumental task indeed.  However, this is where the focus on preventing explosions frequently lies.  This requires constant and careful inspection of all wiring and potential power sources.  Another consideration is that fire is a potential ignition source.  Obviously a goal of any organization is always to avoid fires in the processing equipment, but if preventing ignition is to be the primary way to avoid dust explosions, improved fire extinguishing systems may be required.  If dust explosion is a risk, automatic fire extinguishing systems should be considered.

Preventing dust explosions is a daunting task.  But we see as we examine the statistics – 281 fires and explosions over 25 years, many of them destroying lives and buildings – it is something that must be done.  Once we have completed the root cause analysis, we can look for solutions and then set about implementing them.

Florida Officials can’t figure out what caused the power outages that occurred Tuesday, February 26, 2008.  There are many things that contributed to the outages, but none of them should have been sufficient to cause outages of the extent that occurred.  A root cause analysis can come in handy, even if all the causes aren’t known.  The whole purpose of these analyses is to show the factors that caused a given problem.  Frequently we do that simply by arranging root causes that we already know, to ensure that we’ve covered all the bases.  Well, we can do the same thing in the middle of an investigation, even if we’re not sure what all the causes were.  In fact, the exercise can assist us in finding the problem.  So, we’ll map what we know, leaving question marks in areas of uncertainty.  A root cause analysis, based on what is known at the time, is shown below. 

First, what is the impact to the goals?  Well, a power company strives to provide electricity, so when 3 million people are left without power, it’s an impact to the customer service goals.  Additionally, having a reduction in the amount of electricity available is an impact to the production goal.  People lost power for two reasons: 1) the decrease in power distribution capability and 2) the reduction of power available.  There was less power available because Florida was unable to borrow from other states, due to the fact that it has fewer connections because of its geographic distance from other states. 

 There was also less power because three power plants (2 nuclear, 1 natural gas) were shut down.  These plants automatically shut down when they register a disturbance in the electrical grid in order to protect the equipment from voltage fluctuations.  The disturbance in the electrical grid (and the reason for the decrease in power distribution capability) was due to the disabling of two power distribution lines.  After this is where it gets fuzzy.  We’re not sure why the two lines were disabled.  We know that there was a fire at the substation, and a failed switch, which caused a short circuit.  But we’re not sure how those happened either.  It’s possible that the short circuit was the root cause of the fire, but for now we’ll just leave it like this.  Looking below, we see that we have a high-level root cause analysis nearly completed, and that the focus of our analysis should be on what caused the disabling of the power distribution lines, and what caused the fire and switch failure at the substation. 

Even if our thoughts on a problem aren’t complete, it can help immensely to organize them by performing a root cause analysis, even if there are some holes (shown with question marks).  It’s a great place to begin!

I wanted to add a few more interesting facts on the recent beef recall as the ramifications continue to surface.  As a quick recap, on February 17, 143 millions pounds of beef were recalled.  For perspective, that’s enough beef to make every person in the US about two hamburgers.  The scope of the recall is rapidly expanding and it may become the largest food recall in US history.  The full magnitude of the recall is just now becoming apparent because it takes weeks to track down all the products containing the recalled beef. 

Take a second to think of all the products in a grocery store that contain beef and you can imagine how large this recall is likely to become.  The amount of food that is going to be destroyed is mind boggling and the cost is likely to be in the hundreds of millions of dollars.  Keep in mind that no cases of illness have been reported, a large amount of the beef has already been consumed, and the U.S. Department of Agriculture classifies the risk to consumers as remote.  Does it make sense to destroy all this food? As you consider the scope of the recall, I ask you also to consider a root cause analysis of the problem. 

The previous blog asked the question, what is the best approach to prevent this type of problem from happening again? I still don’t now the answer, but I do know that a recall alone does not solve the initial problems that caused the issue.  What cause really lead to sick cows being mistreated and then slaughtered for human consumption?  A recall deals with the problem after the fact and a good solution would change something in the process prior to the meat entering the food chain.  The USDA has stated that it will not be increasing inspections at food processing plants and I haven’t found any evidence that other changes are being made in the work process at the slaughterhouses.  I’ll be continuing to cook my meat well done.

One of the most interesting things about root cause analysis is its widespread application.   As an engineer, I tend to think about root cause analysis applying to mechanical failures, safety incidents or manufacturing issues, but it can be applied to any system. 

Take for instance the recent beef recall.  The largest beef recall in US history was initiated on February 17 when Westland/Hallmark Meat Company recalled 143 million pounds of beef.  What started the whole thing was an undercover video distributed by the Humane Society of the United States which showed workers kicking, shocking and even fork-lifting sick cows to force them on their feet so they could be slaughtered.  Beyond the animal cruelty issues (two workers involved have since been charged), the issue is that meat from sick cows was processed and sold.  Government regulations ban cows that can not walk from entering the food supply because consumption of their meat may lead to illness, including mad cow disease. 

So how did sick cows end up being slaughter and sold to millions of people?  What is the best approach to prevent this type of problem from happening again?  Is the answer that we need more government regulations, more frequent inspections or stricter penalties for companies that violate the current regulations?  Whose fault is it?  Is it the farmers for selling the cows, the health inspectors for missing sick cows or the slaughterhouses for processing sick cows?  Performing a root cause analysis would show you that there isn’t one right single answer.  All you have to do is look at the recent increase in beef recalls to realize that a simple, single cause solution won’t work.  There were five recalls in 2005, eight in 2006 and 21 recalls in 2007.  These recalls were not limited to one plant or even one company.  Clearly, fining one company or firing a few workers isn’t going to fix the beef supply issues.  You need to attack the root of the problem to keep it from growing back and to do that you need to find the root causes (plural).  The information needed to do a detailed analysis isn’t available to the public yet, but a very basic root cause analysis follows.

For a particular failure, loss or incident, people will naturally disagree about what the problem is.  Some people will say the problem is this and others will say the problem is that and still others will let everyone know what the real problem is.  People see problems differently.  This is a given for any root cause analysis facilitator.

Is it possible for everyone to agree on the problem?  Yes.  It may seem unrealistic until we look specifically at what a problem is.  A problem is anything that negatively affects the ideal state.  People may see many different issues as a problem, but within an organization the ideal state is already defined.  The ideal state within an organization is also known as the overall goals.  Any negative deviation from the organization’s overall goals is the accurate, complete and consistent approach for defining a problem.  For example, let’s consider your local power plant.

What is the ideal state of that power plant?  Let’s say the power plant is supposed to produce 1000 megawatts per day.  Any negative deviation from 1000 megawatts is a problem.  If the plant produced 900 megawatts then the deviation is 100 megawatts (a production loss).  We could even put an economic value on this production loss.  But producing power is not the only goal of the power plant.  Organizations don’t have a goal.  They always have goals (plural).

The safety goal for the power plant is zero injuries.  Any injury is a deviation from the ideal state.  Some safety incidents are more critical than others.  The larger the magnitude of the impact to the goals the more thorough the investigation is.  A paper cut is an injury, but it’s not as serious as someone receiving 15 stitches.  Some problems are bigger than others.  The magnitude of the impact on the goals dictates importance as well as how thorough the investigation will be.  Minor incidents have relatively basic investigations while major issues require much more comprehensive analyses.

The ideal state of the power plant also includes no environmental issues as well as no customer service interruptions, no property or material losses, and no excess reactive or rework labor costs.  The overall goals of the power plant are safety, environmental, compliance, customer, production, and materials and labor (which are usually captured within maintenance).  Any negative deviation to any one of these overall goals is truly what the power plant should focus on for their problem solving and root cause analysis efforts…everyday.

The overall goals change for each type of organization.  A hospital has different overall goals than a food processor, an oil company or a bank.  Regardless of the organization or industry, the impact to the overall goals dictates where the root cause analysis efforts should be.

The Cause Mapping method to root cause analysis has a specific way of defining every problem by the organization’s overall goals.  People naturally disagree about what the problem is.  In the Cause Mapping method of root cause analysis it’s much simpler for the facilitator to accommodate disagreements about the problem – it’s expected.  The differences provide great insight into people’s view of the problem.  To get agreement, ask the participants, as a group, how each of the overall goals were impacted (if at all).  Amazingly, people will not disagree about the impact to the goals.  They will disagree about the responses to the question “What’s the problem?”  However, they will give the same answers to each of the goal questions.  Managers and front line people will give the same answers.  It’s powerful because it’s so basic.  Goals dictate what the problems are.

During an injury investigation in the power plant where someone sprained their ankle, when the facilitator asks “Was anyone hurt?” everyone will answer with “yes, John sprained his ankle.”  It’s obvious.  If you ask what the problem, people’s responses will be all over the place; he just tripped, the barrier is bad, maybe the floor was slick, inattention to detail, procedure not followed, etc.  In your problem solving and root cause analysis investigations experiment with this idea of defining every incident by the impact it has on the overall goals.

To learn more about quickly, clearly and accurately defining problems in your business attend one of our Public Cause Mapping Workshops listed on our web site or bring our workshop to your facility.  The Cause Mapping method is an extremely effective systems-based approach to root cause analysis.  Visit us at www.ThinkReliability.com to learn more about improving the way your organization analyzes, documents, communicates and solves problems.

Who knew that tiny particles of sugar dust could be so dangerous?  Federal investigators’ analysis has shown that the explosion at the Imperial Sugar factory was accidental, and was caused by ignition of clouds of sugar dust.  When I think of sugar dust, making cotton candy is what comes to mind.  However, when the stuff builds up, it can ignite and explode.

To avoid this problem, Imperial has extraction equipment that moves all the dust particles up to dust collectors on the roof.  Apparently there was an explosion three weeks before the recent deadly explosion resulting from ignition of accumulated sugar dust in one of these dust collectors.  The sugar dust was apparently ignited by a small piece of metal that got into the equipment and created a spark.  The good news, for this earlier, more minor explosion, was that the ventilation panels in the dust collector opened as designed to minimize damage.  It’s unclear how this explosion may or may not have played into the more recent, fatal explosion, but one thing is clear: they weren’t so lucky this time.

On the February 7th explosion, which has killed eleven workers so far (fourteen are still in critical condition), the ignition occurred in a basement area beneath the plant’s storage silos.  Although this area also has extraction equipment, investigators have determined that there was still enough dust there to cause the explosion and feed the subsequent fire, which raged for a week.  What they don’t know, yet, is whether the extraction equipment was working, and what caused the sugar dust to explode.  A very basic root cause analysis follows, based on the information known so far.

ThinkReliability investigates problems, including historical incidents.  Some examples of these incidents include, but are not limited to, the sinking of the Titanic, the Tacoma Narrows Bridge, the Exxon Valdez oil spill and the BP Refinery Explosion in Texas City.  The Cause Mapping method of root cause analysis was used to create a visual picture of the cause and effect relationships of the incidents.