Root Cause Analysis - Incident Investigation

Live anthrax mistakenly shipped to as many as 24 labs

By Kim Smiley

The Pentagon recently announced that live anthrax samples were mistakenly shipped to as many as 24 laboratories in 11 different states and two foreign countries.  The anthrax samples were intended to be inert, but testing found that at least some of the samples still contained live anthrax.  There have been no reports of illness, but more than two dozen have been treated for potential exposure.  Work has been disrupted at many labs during the investigation as testing and cleaning is performed to ensure that no unaccounted-for live anthrax remains.

The investigation is still ongoing, but the issues with anthrax samples appear to have been occurring for at least a year without being identified.  The fact that some of the samples containing live anthrax were transported via FedEx and other commercial shipping companies has heightened concern over possible implications for public safety.

Investigations are underway by both the Centers for Disease Control and the Defense Department to figure out exactly what went wrong and to determine the full scope of the problem. Initial statements by officials indicated that there may be problems with the procedure used to inactivate the anthrax.   Investigators so far have indicated that the work procedure was followed, but it may not have effectively killed 100 percent of the anthrax as intended.  Technicians believed that the samples were inert prior to shipping them out.

It may be tempting to call the issues with the work process used to inactivate the anthrax as the “root cause” of this problem, but in reality there is more than one single cause that contributed to this issue and more than one solution should be used to reduce the risk of future problems to acceptable levels.  Clearly, there is a problem if the procedure used to create inactive anthrax samples doesn’t kill all the bacteria present and that will need to be addressed, but there is also a problem if there aren’t appropriate checks and testing in place to identify that live anthrax remains in samples.  When dealing with potentially deadly consequences, a work process should be designed where a single failure cannot create a dangerous situation if possible.  An effective test for live anthrax prior to shipping the sample would have contained the problem to a single facility designed to handle live anthrax and drastically reduced the impact of the issue.  Additionally, an another layer of protection could be added by requiring that a facility receiving anthrax samples test them upon receipt and handle them with additional precautions until they were determined to be fully inert.

Building in additional testing does add time and cost to a work process, but sometimes it is worth it to identify small problems before they become much larger problems.  If issues with the process used to create inert anthrax samples were identified the first time it failed to kill all the anthrax, it could have been dealt with long before it was headline news and people were unknowingly exposed to live anthrax. Testing both before shipping and after receipt of samples may be overkill in this case, but something more than just working to fix the process for creating inert sample needs to be done because inadvertently shipping live anthrax for more than a year indicates that issues are not being identified in a timely manner.

6/4/2015 Update: It was announced that anthrax samples that are suspected of inadvertently containing live anthrax were sent to 51 facilities in 17 states, DC and 3 foreign countries (Australia, Canada and South Korea). Ten samples in 9 states have tested positive for live anthrax and the number is expected to grow as more testing is completed. 31 people have been preventative treated for exposure to anthrax, but there are still no reports of illness. Click here to read more.

Root Cause Analysis - Incident Investigation

Deadly Train Derailment Near Philadelphia

By Kim Smiley

On the evening of May 12, 2015, an Amtrak train derailed near Philadelphia, killing 8 and injuring more than 200.  The investigation is still ongoing with significant information about the accident still unknown, but changes are already being implemented to help reduce the risk of future rail accidents and improve investigations.

Data collected from the train’s onboard event recorder shows that the train sped up in the moments before the accident until it was traveling 106 mph in a 50 mph zone where the train track curved.  The excessive speed clearly played a role in the accident, but there has been little information released about why the train was traveling so fast going into a curve.  The engineer controlling the train suffered a head injury during the accident and has stated that he has no recollection of the accident. The engineer was familiar with the route and appears to have had all required training and qualifications.

As a result of this accident and the difficulty determining exactly what happened, Amtrak has announced that cameras will be installed inside locomotives to record the actions of engineers.  While the cameras may not directly reduce the risk of future accidents, the recorded data will help future investigations be more accurate and timely.

The excessive speed at the time of the accident is also fueling the ongoing debate about how trains should be controlled and the implementation of positive train control (PTC) systems that can automatically reduce speed.  There was no PTC system in place at the curve in the northbound direction where the derailment occurred and experts have speculated that one would have prevented the accident. In 2008, Congress mandated nationwide installation and operation of positive train control systems by 2015.  Prior to the recent accident, the Association of America Railroads stated that more than 80 percent of the track covered by the mandate will not have functional PTC systems by the deadline. The installation of PTC systems requires a large commitment of funds and resources as well as communication bandwidth that has been difficult to secure in some area and some think the end of year deadline is unrealistic. Congress is currently considering two different bills that would address some of the issues.  The recent deadly crash is sure to be front and center in their debates.

In response to the recent accident, the Federal Railroad Administration ordered Amtrak to submit plans for PTC systems at all curves where the speed limit is 20 mph less than the track leading to the curve for the main Northeast Corridor (running between Washington, D.C. and Boston).  Only time will tell how quickly positive train control systems will be implemented on the Northeast Corridor as well as the rest of the nation, and the debate on the best course of action will not be a simple one.

An initial Cause Map, a visual root cause analysis, can be created to capture the information that is known at this time.  Additional information can easily be incorporated into the Cause Map as it becomes available.  To view a high level initial Cause Map of this accident, click on “Download PDF”.

Uncategorized

Indian Point Fire and Oil Leak

By Sarah Wrenn

At 5:50 PM on May 9, 2015, a fire ignited in one of two main transformers for the Unit 3 Reactor at Indian Point Energy Center. These transformers carry electricity from the main generator to the electrical grid. While the transformer is part of an electrical system external to the nuclear system, the reactor is designed to automatically shut down following a transformer failure. This system functioned as designed and the reactor remains shut down with the ongoing investigation. Concurrently, oil (dielectric fluid) spilled from the damaged transformer into the plant’s discharge canal and some amount was also released into the Hudson River. On May 19, Fred Dacimo, vice president for license renewal at Indian Point and Bill Mohl, president of Entergy Wholesale Commodities, stated the transformer holds more than 24,000 gallons of dielectric fluid. Inspections after the fire revealed 8,300 gallons have been collected or were combusted during the fire. As a result, investigators are working to identify the remaining 16,000 gallons of oil. Based on estimates from the Coast Guard supported by NOAA, up to approximately 3,000 gallons may have gone into the Hudson River.

The graphic located here provides details regarding the event, facility layout and response.

Step 1. Define the Problem

There are a few problems in this event. Certainly, the transformer failure and fire are major problems. The transformer is an integral component to transfer electricity from the power plant to the grid. Without the transformer, production has been halted. In addition, there is an inherent risk of injury with the fire response. The site’s fire brigade was dispatched to respond to the fire and while there were no injuries, there was a potential for injury. In addition, the release of dielectric fluid and fire-retardant foam into the Hudson River is a problem. A moat around the transformer is designed to contain these fluids if released, but evidence shows that some amounts reached the Hudson River.

As shown in the timeline and noted on our problem outline, the transformer failure and fire occurred at 5:50 PM and was officially declared out 2.25 hours later.

As far as anything out of the ordinary or unusual when this event occurred, Unit 3 had just returned to operations after a shutdown on May 7 to repair a leak of clean steam from a pipe on the non-nuclear side of the plant. Also, it was noted that this is the 3rd transformer failure in the past 8 years. This frequency of transformer failures is considered unusual. The Wall Street Journal reported that the transformer that failed earlier this month replaced another transformer that malfunctioned and caught fire in 2007. Another transformer failed in 2010, which had been in operation for four years.

Multiple organizational goals were negatively impacted by this event. As mentioned above, there was a risk of injury related to the fire response. There was also a negative impact to the environment due to the release of dielectric fluid and fire-retardant foam. The negative publicity from the event impacts the organization’s customer service goal. A notification to the NRC of an Unusual Event (the lowest of 4 NRC emergency classifications) is a regulatory impact. For production/schedule, Unit 3 was shutdown May 9 and remains shutdown during the investigation. There was a loss of the transformer which needs to be replaced. Finally, there is labor/time required to address and contain the release, repair the transformer, and investigate the incident.

Step 2. Identify the Causes (Analysis)

Now that we’ve defined the problem in relation to how the organization’s goals were negatively impacted, we want to understand why.

The Safety Goal was impacted due to the potential for injury. The risk of injury exists because of the transformer fire.

 

 

The Regulatory Goal was impacted due to the notification to the NRC. This was because of the Unit 3 shutdown, which also impacts the Production/Schedule Goal. Unit 3 shutdown as this is the designed response to the emergency. This is the designed response because of the loss of the electrical transformer, which also impacts the Property/Equipment Goal. Why was the electrical transformer lost? Because of the transformer fire.

For the other goals impacted, Customer Service was because of the negative publicity which was caused by the containment, repair, investigation time and effort. This time and effort impacts the organization’s Labor/Time Goal. This time and effort was required because of the dielectric fluid and fire-retardant foam release. Why was there a release? Because the fluid and foam were able to access the river.

Why did the fluid and foam access the river?

The fire-retardant foam was introduced because the sprinkler system was ineffective. The transformer is located outside in the transformer yard which is equipped with a sprinkler system. Reports indicate that the fire was originally extinguished by the sprinklers, but then relit. Fire responders introduced fire-retardant foam and water to more aggressively address the fire. Some questions we would ask here include why was the sprinkler system ineffective at completely controlling the fire? Alternatively, is the sprinkler system designed to begin controlling the fire as an immediate response such that the fire brigade has time to respond? If this is the case, then did the sprinkler perform as expected and designed?

The transformer moat is designed to catch fluids and was unable to contain the fluid and the foam. When a containment is unable to hold the amount of fluid that is introduced, this means that either there is a leak in the containment or the amount of fluid introduced is greater than the capacity of the containment. We want to investigate the integrity of the containment and if there are any leak paths that would have allowed fluids to escape the moat. We also want to understand the volume of fluid that was introduced. The moat is capable of holding up to 89,000 gallons of fluid. A transformer contains approximately 24,000 gallons of dielectric fluid. What we don’t know is how much fire-retardant foam was introduced. If this value plus the amount of transformer fluid is greater than the capacity of the moat, then the fluid will overflow and can access the river. If this is the case, we also would want to understand if the moat capacity is sufficient, should it be larger? Also, is the moat designed such that an overflow will result in accessing the discharge canal and is this desired?

Finally, dielectric fluid accessed the river because the fluid was released from the transformer. Questions we would ask here are: Why was the fluid released and why does a transformer contain dielectric fluid? Dielectric fluid is used to cool the transformers. Other cooling methods, such as fans are also in place. The causes of the fluid release and transformer failure is still being investigated, but in addition to determining these causes, we would also ask how are the transformers monitored and maintained? The Wall Street Journal provided a statement from Jerry Nappi, a spokesman for Entergy. Nappi said both of unit 3’s transformers passed extensive electrical inspections in March. Transformers at Indian Point get these intensive inspections every two years. Aspects of the devices also are inspected daily.

Finally, we want to understand why was there a transformer fire. The transformer fire occurred because there was some heat source (ignition source), fuel, and oxygen. We want to investigate what was the heat source – was there a spark, a short in the wiring, a static electricity build up? Also, where did the fuel come from and is it expected to be there? The dielectric fluid is flammable, but are there other fuel sources that exist?

Step 3. Select the Best Solutions (Reduce the Risk)

What can be done? With the investigation ongoing, a lot of facts still need to be gathered to complete the analysis. Once that information is gathered, we want to consider what is possible to reduce the risk of having this type of event occur in the future. We would want to evaluate what can be done to address the transformer, implementing solutions to better maintain, monitor, and/or operate it. Focusing on solutions that will minimize the risk of failure and fire. However, if a failure does occur, we want to consider solutions so that the failure and fire does not result in a release. Further, we can consider the immediate response; do these steps adequately contain the release? Identifying specific solutions to the causes identified will provide reductions to the risk of future similar events.

Resources:

This Cause Map was built using publicly available information from the following resources.

De Avila, Joseph “New York State Calls for Tougher Inspections at Indian Point” http://www.wsj.com/articles/nuclear-regulatory-commission-opens-probe-at-indian-point-1432054561 Published 5/20/2015. Accessed 5/20/2015

“Entergy’s Response to the Transformer Failure at Indian Point Energy Center” http://www.safesecurevital.com/transformer_update/ Accessed 5/19/2015

“Entergy Plans Maintenance Shutdown of Indian Point Unit 3” http://www.safesecurevital.com/entergy-plans-maintenance-shutdown-of-indian-point-unit-3/ Published 5/7/2015. Accessed 5/19/2015

“Indian Point Unit 3 Safely Shutdown Following Failure of Transformer” http://www.safesecurevital.com/indian-point-unit-3-safely-shutdown-following-failure-of-transformer/ Published 5/9/2015. Accessed 5/19/2015

“Entergy Leading Response to Monitor and Mitigate Potential Impacts to Hudson River Following Transformer Failure at Indian Point Energy Center” http://www.safesecurevital.com/entergy-leading-response-to-monitor-and-mitigate-potential-impacts-to-hudson-river-following-transformer-failure-at-indian-point-energy-center/ Published 5/13/2015. Accessed 5/19/2015

“Entergy Continues Investigation of Failed Transformer, Spilled Dielectric Fluid at Indian Point Energy Center” http://www.safesecurevital.com/entergy-continues-investigation-of-failed-transformer-spilled-dielectric-fluid-at-indian-point-energy-center/ Published 5/15/2015. Accessed 5/19/2015

McGeehan, Patrick “Fire Prompts Renewed Calls to Close the Indian Point Nuclear Plant” http://www.nytimes.com/2015/05/13/nyregion/fire-prompts-renewed-calls-to-close-the-indian-point-nuclear-plant.html?_r=0 Published 5/12/2015. Accessed 5/19/2015

Screnci, Diane. “Indian Point Transformer Fire” http://public-blog.nrc-gateway.gov/2015/05/12/indian-point-transformer-fire/comment-page-2/#comment-1568543 Accessed 5/19/2015

Root Cause Analysis - Incident Investigation

New Regulations Aim to Reduce Railroad Crude Oil Spills

By ThinkReliability Staff

The tragic train derailment in Lac-Mégantic, Quebec on July 6, 2013 (see our previous blog on this topic) ushered in new concerns about the transport of crude oil by rail in the US and Canada. Unfortunately, the increased attention has highlighted a growing problem: spills of crude oil transported via rail, which can result in fires, explosions, evacuations, and potentially deaths. (Luckily there have been no fatalities since the Lac-Mégantic derailment.) According to Steve Curwood of Living on Earth, “With pipelines at capacity the boom has lead a 4,000 percent increase in the volume of crude oil that travels by rail, and that brought more accidents and more oil spills in 2014 than over the previous 38 years.”

This follows a period of increases in railroad safety – according to the US Congressional Research Service, “From 1980 to 2012, railroads reduced the number of accidents releasing hazmat product per 100,000 hazmat carloads from 14 to 1.” From October 19, 2013 to May 6, 2015, there were at least 12 railcar derailments that resulted in crude oil spills. (To see the list of events, click on “Download PDF” and go to the second page.)

Says Sarah Feinberg, acting administrator of the Federal Railroad Administration (FRA), “There will not be a silver bullet for solving this problem. This situation calls for an all-of-the-above approach – one that addresses the product itself, the tank car it is being carried in, and the way the train is being operated.” All of these potential risk-reducing solutions are addressed by the final rule released by the FRA on May 1, 2015. (On the same day, the Canadian Ministry of Transport released similar rules.) In order to view how the various requirements covered by the rule impact the risk to the public as a result of crude oil spills from railcars, we can diagram the cause-and-effect relationships that lead to the risk, and include the solutions directly over the cause they control. (To view the Cause Map, or visual root cause analysis, of crude oil train car derailments, click on “Download PDF”.)

The product: Bakken crude oil (as well as bitumen) can be more volatile than other types of crude oil and has been implicated in many of the recent oil fires and explosions. In addition to being more volatile, the composition (and thus volatility) can vary. If a material is not properly sampled and characterized, proper precautions may not be taken. The May 1 rule incorporates a more comprehensive sampling and testing program to ensure the properties of unrefined petroleum-based products are known and provided to the DOT upon request.   (Note that in the May 6, 2015 derailment and fire in Heimdahl, North Dakota, the oil had been treated to reduce its volatility, so this clearly isn’t an end-all answer.)

The tank car: Older tank cars (known as DOT-111s) were involved in the Lac-Mégantic and other 2013 crude oil fires. An upgrade to these cars, known as CPC-1232, hoped to reduce these accidents. However, CPC-1232 cars have been involved in all of the issues since 2013. According to Cynthia Quarterman, former director of the Pipeline and Hazardous Materials Safety Administration, says that the recent accidents involving the newer tank cars “confirm that the CPC-1232 just doesn’t cut it.”

The new FRA rule establishes requirements for any “high-hazard flammable train” (HHFT) transported over the US rail network. A HHFT is a train comprised of 20 or more loaded tank cars of a Class 3 flammable liquid (which includes crude oil and ethanol) in a continuous block or 35 or more loaded tank cars of a Class 3 flammable liquid across the entire train. Tank cars used in HHFTs constructed after October 1, 2015 are required to meet DOT-117 design criteria, and existing cars must be retrofitted based on a risk-based schedule.

The way the train is being operated: The way the train is being operated includes not only the mechanics of operating the train, but also the route the train takes and the notifications required along the way. Because the risk for injuries and fatalities increases as the population density increases, the rule includes requirements to perform an analysis to determine the best route for a train. Notification of affected jurisdictions is also required.

Trains carrying crude oil tend to be very large (sometimes exceeding one mile in length). This can impact stopping distance as well as increase the risk of derailment if sudden stopping is required. To reduce these risks, HHFTs are restricted to 50 mph in all areas, and 40 mph in certain circumstances based on risk (one of the criteria is urban vs. rural areas). HHFTs are also required to have in place a functioning two-way end of train or distributed power braking system. Advanced braking systems are required for trains including 70 or more loaded tank cars containing Class 3 flammable liquids and traveling at speeds greater than 30 mph, though this requirement will be phased in over decades.

It is important to note that this new rule does not address inspections of rails and tank cars. According to a study of derailments from 2001 to 2010, track problems were the most important causes of derailments (with broken rails or track welds accounting for 23% of total cars derailed). A final rule issued January 24, 2014 required railroads to achieve a specified track failure rate and to prioritize remedial action.

To view the May 1 rule regarding updates to crude-by-rail requirements, click here. To view the timeline of incidents and the Cause Map showing the cause-and-effect relationships leading to these incidents, click “Download PDF”.

Root Cause Analysis - Incident Investigation

ISS Supply Mission Fails

By Kim Smiley

An unmanned Progress supply capsule failed to reach the International Space Station (ISS) and is expected to burn up during reentry in the atmosphere along with 3 tons of cargo.  Extra supplies are stored on the ISS and the astronauts onboard are in no immediate danger, but the failure of this supply mission is another in a string of high-profile issues with space technology.

This issue can be analyzed by building a Cause Map, a visual format of root cause analysis.  A Cause Map intuitively lays out the causes that contributed to an issue to show the cause-and-effect relationships.  To build a Cause Map, “why” questions are asked and the answers are documented on the Cause Map along with any relevant evidence to support the cause.

So why did the supply mission fail? The mission failed because the supply capsule was unable to dock with the ISS because mission control was unable to communicate with the spacecraft.  The Progress is an unmanned Russian expendable cargo  capsule that cannot safely dock with a space station without communication with mission control.  Mission control needs to be able to verify that all systems are functional after launch and needs a communication link to navigate the unmanned capsule through docking.

Images of the capsule showed that two of the five antennas failed to unfold leading to the communication issues.  Debris spotted around the capsule while it was in orbit indicates a possible explosion.  No further information has been released about what might have caused the explosion and it may be difficult to decisively determine the cause since the capsule will be destroyed in orbit.

The ISS recycles oxygen and water to an impressive degree and food is the first supply that would run out on the ISS, but NASA has stated that there are at least four months of food onboard at this time.  The failure of this mission may mean that the cargo for future missions will need to be altered to include more basic necessities and less scientific equipment, but astronaut safety is not a concern at this time. The failure of this mission does put additional pressure on the next resupply mission scheduled to be done by SpaceX in June in addition to creating more bad press for space programs that are already struggling during a turbulent time.

To view a intermediate Cause Map of this issue, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Earthquake Hits Nepal

By Kim Smiley

As anyone paying any attention to the news knows, a magnitude 7.8 earthquake hit Nepal on April 25, 2015.   The same forces that created the Himalayan Mountains are still at work in the region as the Indo-Australian Plate slowly slides under the Eurasian Plate and experts have long warned about the potential for an earthquake in this location.

At least 4,600 people were killed as a result of the earthquake and the United Nations has stated that 8 million people have been affected.  Many people impacted by the disaster lack adequate water and food and are living in temporary shelters without sanitation facilities.  Beyond the sheer scope of the natural disaster, providing emergency assistance has also been difficult because some of the affected villages are in remote locations that are challenging to access and many roads were damaged by the earthquake.  The long-term economic impacts are also predicted to be large because of the significant damage to infrastructure and the fact that local economies relay heavily on tourism.

A Cause Map, a visual root cause analysis, can be built to help understand this disaster better. A Cause Map lays out the cause-and-effect relationships in an intuitive format by asking “why” questions.  In this tragic example, asking why so many fatalities occurred shows that the majority of deaths were caused by collapsing buildings.  Many buildings in the impacted area were unreinforced masonry structures that couldn’t withstand the force of the earthquake.  These buildings are cheaper and quicker to build than more modern construction that would meet building codes designed to survive an earthquake.

Civil unrest in the region has resulted in rapid urbanization and a large demand for housing as people moved into cities. Rapid and relatively unregulated urbanization in a country with one of the lowest per capita incomes in the world proved to be a deadly combination in a region prone to earthquakes. Historically a major earthquake has struck this region about every 75 years and this one had long been predicted.  Says Susan Hough, a geologist with the U.S. Geological Survey, “It was clearly a disaster in the making that was getting worse faster than anyone was able to make it better. You’re up against a Himalayan-scale problem with Third World resources.”

Every disaster and the emergency response to it should be studied to see if there are any lessons learned that can be used to save lives and minimize damage in the future. There is clearly no “solution” that can prevent an earthquake, but even when dealing with a natural disaster there are ways the impact of a disaster could be mitigated.  The possible solutions may not be cheap or easy, but it is important to remember that it is possible. You can’t stop the earthquake, but you can work to build stronger buildings.

Root Cause Analysis - Incident Investigation

Concrete slab smashes truck killing 3

By Kim Smiley

On April 13, 2015, a large section of a concrete barrier fell from an overpass onto a truck in Bonney Lake, Washington. A couple and their baby were in the vehicle and were all killed instantly. Investigators are working to determine what caused this accident and to determine why the road under the overpass remained open to traffic while construction was being done on the overpass.

A Cause Map, a visual method of root causes analysis, can be built to help understand this accident. More information is still needed to understand the details of the accident, but an initial Cause Map can be created now to capture what is known and it can be easily expanded to include additional information as it becomes available. A Cause Map is created by asking “why” questions and visually laying out the answers to show the cause-and-effect relationships. (Click here to learn more about basics of Cause Mapping.)

In this accident, three people were killed because the vehicle they were riding in was smashed by a large slab of concrete. The vehicle was hit by the concrete slab because it was accidently dropped and the truck was under the overpass at the time it fell because the road was open to traffic. (When two causes are both needed to produce and effect, the causes are listed on vertically on the Cause Map and separated by and “and”.) The road would typically have been closed to traffic while heavy work was performed on the overpass, but the work plan for the construction project did not indicate that any heavy work would be performed on the day of the accident.   At some point the actual work schedule must have deviated from the planned schedule, but no change was made in plan for managing traffic resulting in traffic traveling under the overpass while potentially dangerous construction was performed.

Investigators are still working to understand exactly why the concrete slab fell, but early indication is that temporary metal bracing that was supporting the concrete may have failed due to buckling. The concrete barrier on the overpass were being cut into pieces at the time of the accident so that they could be removed as part of a $1.7 million construction project to improve pedestrian access which included adding sidewalks and lights.

Once the details of what causes this tragic accident are better understood, solutions can be developed and implemented that will help reduce the risk of something like this happening again. To view a high level Cause Map of this accident, click on “Download PDF” above.

You can also read a previous blog “Girder Fell on Car, Killing 3” to learn more about a similar accident that occurred in 2004.

Root Cause Analysis - Incident Investigation

Distraction Related Accidents: Eyes on Road, Hands on Wheel, AND Mind on Task

By  Sarah Wrenn

Admit it – you’ve checked your phone while driving.  We’ve likely all been guilty of it at some point.  And despite knowing that we’re not supposed to do it – it’s against the law in most states and we understand that the distraction increases our risk of having an accident – we still do it.  Why?

On March 31, 2015, the National Transportation Safety Board (NTSB) held its first roundtable discussion on distractions within the transportation industry.  In 2015, the NTSB added “Disconnect from Deadly Distractions” to its “Most Wanted List of Transportation Safety Improvements for 2015.”  This list represents the NTSB’s priorities to increase awareness and support for key issues related to transportation safety.  Other critical topics include “Make Mass Transit Safer” and “Require Medical Fitness for Duty.”

Representatives from all modes of transportation, technology, law enforcement, insurance, researchers, advocates, and educators came together for discussion related to distractions facing vehicle operators.

“New technologies are connecting us as never before – to information, to entertainment, and to each other,” said NTSB Member Robert Sumwalt. “But when those technologies compete for our attention while we’re behind the wheel of a car or at the controls of other vehicles, the results can be deadly.”

Digging into the causes

So let’s take a look at some of the causes related to an accident where the operator is distracted.  In addition to the accident occurring because of the distraction, the level of driver expertise is also a factor.  A large effort has been made to raise awareness and provide education to teenage drivers.  This is in part because, as novice drivers, they have a more limited exposure to driving situations and may not have the ability to react as a more skilled driver.

Operators become distracted

We also want to understand the causes that led to the operator being distracted.  There is a distraction type (or mode) that was introduced, the duration of the distraction, and the individual’s inability to ignore the distraction that result in the operator distraction.  While the type of distraction plays a large role in taking the operator’s eyes off the road, hands off the wheel or mind off the task, the duration of the distraction also is a key factor.  For example, while one’s eyes remain on the road during a phone call, the duration of that call disengages the brain from the task for more time than the act of dialing the phone.  This is not to say that one of these actions is more or less impactful; it is important to note that they both play a role in distracting the individual.

It’s not just the text that is distracting

There are three primary forms of distractions – Visual (taking eyes off of the road), Manual (taking hands off of the wheel), and Cognitive (taking mind off of the task).  Visual and manual types of distractions are very easy to define and generally recognized as risky behaviors while operating a vehicle.  Cognitive distractions are less tangible and therefore more difficult to define.  Research and studies generally define cognitive distractions as when the individual’s attention is divided between two or more tasks.  While technology and activities such as texting or talking on the phone are typically identified as the primary forms of distraction, it is interesting to note that cognitive distractions such as allowing your mind to wander while operating a vehicle can be just as risky.  The AAA Foundation released a 2013 study “Measuring Cognitive Distraction in the Automobile.”  The study rates various tasks such as using a hands-free cell phone and listening to the radio according to the amount of cognitive workload imposed upon an operator.  The study concludes that “while some tasks, like listening to the radio, are not very distracting, others – such as maintaining phone conversations and interacting with speech-to-text systems – place a high cognitive demand on drivers and degrade performance and brain activity necessary for safe driving.”

The forum discussed the concept that ability to multi-task is actually a myth, with evidence and data to conclude that for certain types of activities multi-tasking is not only difficult, but impossible.  For example, tasks such as navigation and speech require the use of the same circuits within the brain.  As such, the brain cannot do both tasks at once.  Instead, the brain is switching between these tasks, resulting in a reduction of focus on the primary task (driving) while attempting to perform a secondary task (speaking).  Therefore, attempting to multi-task introduces a cognitive distraction that increases the risk of unsafe driving.

Just ignore it

Why don’t we just ignore the temptation to become distracted?

Our brains function by releasing serotonin and dopamine when an action occurs that makes us feel good.  Dr. Paul Atchley of the University of Kansas stated: “There is nothing more interesting to the human brain than other people.  I don’t care how you design your vehicle or your roadways, if you have technologies in the vehicle that allow you to be social, your brain will not be able to ignore them.  There are only two things we love, serotonin and dopamine.  The two reward chemicals that come along with all those other things that make us feel good.  There is really nothing more rewarding to us than the opportunity to talk to someone else.”

Surveys performed by various organizations have revealed a large percentage of people (sometimes 3 out of 4) that will admit to being distracted while driving.  Meanwhile, a staggering percent (upwards of 90%) will rationalize the behavior which is a sign of addiction.

Finally, the level of brain development controls our ability to respond to distractions.  For example, a teenager has a less developed fontal cortex than an adult which means, as Dr. David Strayer of the University of Utah explains: “Teens’ frontal cortex, the parts of the brain that do decision-making in terms of multitasking, are underdeveloped.”  Much of the focus on distracted driving is focused on teens and this is justified as their brain development is not yet complete.  It is, however, important to note that this is not just an issue for teens who can’t be separated from their phones or seniors who don’t understand them; this is an issue that crosses all demographics.  Level of brain development is just one factor.

So what can we do?

At the end of the day, we want to identify solutions that are going to effectively reduce the risk of having accidents related to distractions from occurring.  While there will always be some risk, it is key to take a comprehensive approach to education, technology, and policy.  Programs like EndDD.org and stopdistractions.org are focused on bringing awareness, education, and training to youth and adults about the risks of operating vehicles while distracted.  Technology can also be used in a variety of ways to reduce the risk of these types of accidents.  Sensors can be built into vehicles to identify distractions and provide alerts to drivers or apps can be used to disable functions of technology so the receipt of calls and texts are delayed.  Finally, establishing policies and laws that are realistic and enforceable is important so that individuals are held accountable for risky behaviors before an accident occurs.  No one single solution is going to reach everyone and no one single solution is going to eliminate the risk of deadly accidents.  Each one of these solutions has limitations, but they also have advantages.  With a balanced approach to raise awareness and education, provide resources and tools to drivers, and change the culture of what is acceptable while driving, we can reduce the amount of accidents and save lives.

References:

NTSB Roundtable: Disconnect from Deadly Distractions held March 31, 2015, from 9:00 a.m. – 4:00 p.m.

AAA Foundation: Measuring Cognitive Distraction in the Automobile, June 2013

Uncategorized

Crash of Germanwings flight 95252 Leads to Questions

By ThinkReliability Staff

On March 24, 2015, Germanwings flight 9525 crashed into the French Alps, killing all 150 onboard. Evidence available thus far suggests the copilot deliberately locked the pilot out of the cockpit and intentionally crashed the plane. While evidence collection is ongoing, because of the magnitude of this catastrophe, solutions to prevent similar recurrences are already being discussed and, in some cases, implemented.

What is known about the crash can be captured in a Cause Map, or visual form of root cause analysis. Visually diagramming all the cause-and-effect relationships allows the potential for addressing all related causes, leading to a larger number of potential solutions. The analysis begins by capturing the impacted goals in the problem outline. In this case, the loss of 150 lives (everybody aboard the plane) is an impact to the safety goal and of primary concern in the investigation. Also impacted are the property goal due to the loss of the plane, and the recovery and investigation efforts (which are particularly difficult in this case due to the difficult-to-access location of the crash.)

Asking “Why” questions from the impacted goals develops cause-and-effect relationships. In this case, the deaths resulted from the crash of the plane into the mountains of the French Alps. So far, available information appears to support the theory that the copilot deliberately crashed the plane. Audio recordings of the pilot requesting re-entry into the cockpit, the normal breathing of the co-pilot, and the manual increase of speed of the descent while crash warnings sounded all suggest that the crash was deliberate. Questions have been raised about the co-pilot’s fitness for duty. Some have suggested increased psychological testing for pilots, but the agency Airlines for America says that the current system (at least in the US), is working: “All airlines can and do conduct fitness-for-duty testing on pilots if warranted. As evidenced by our safety record, the U.S. airline industry remains the largest and safest aviation system in the world as a result of the ongoing and strong collaboration among airlines, airline employees, manufacturers and government.”

Some think that technology is the answer. The flight voice recorder captured cockpit alarms indicating an impending crash. But these were simply ignored by the co-pilot. If flight guidance software was able to take over for an incapacitated pilot (or one who deliberately ignores these warnings, disasters like this one could be avoided. Former Department of Transportation Inspector General Mary Schiavo says, “This technology, I believe, would have saved the flight. Not only would it have saved this flight and the Germanwings passengers, it would also save lives in situations where it is not a suicidal, homicidal pilot. It has implications literally for safer flight across the industry.”

Others say cockpit procedures should be able to prevent an issue like this. According to aviation lawyers Brian Alexander & Justin Green, in a blog for CNN, “If Germanwings had implemented a procedure to require a second person in the cockpit at all times – a rule that many other airlines followed – he would not have been able to lock the pilot out.”

After 9/11, cockpit doors were reinforced to prevent any forced entry (according to the Federal Aviation Administration, they should be strong enough to withstand a grenade blast). The doors have 3 settings – unlock, normal, and lock. Under normal settings, the cockpit can be unlocked by crewmembers with a code after a delay. But under the lock setting (to be used, for example, to prevent hijackers who have obtained the crew code from entering the cockpit), no codes will allow access. (The lock setting has to be reset every 5 minutes.) Because of the possibility a rogue crewmember could lock out all other crewmembers, US airlines instituted the rule that there must always be two people in the cockpit. (Of course, if only a three-person crew is present, this can cause other issues, such as when a pilot became locked in the bathroom while the only other two flight crew members onboard were locked in the cockpit, nearly resulting in a terror alert. See our previous blog on this issue.)

James Hall, the former chairman of the National Transportation Safety Board, agrees. He says, “The flight deck is capable of accommodating three pilots and there shouldn’t ever be a situation where there is only one person in the cockpit.” In response, many airlines in Europe and Canada, including Germanwings’ parent company Lufthansa, have since instituted a rule requiring at least two people in the cockpit at all times.   Other changes to increase airline safety may be implemented after more details regarding the crash are discovered.

Root Cause Analysis - Incident Investigation

THE WOEFUL TALE OF JACK & JILL

By Jon Bernardi

There has been a disturbing rise of injuries once thought to have been eradicated. Several federal and state agencies are considering legislation to address the very dangerous injuries from the gathering of liquid di-hydrogen oxide from certain unprotected hills and wells. Once upon time became the last straw, when siblings Jack and Jill fetched the ill-fated pail. Not only were crowns injured, but various homeopathic remedies were implemented with little consequence except to other participants, notably Jill.

What caused this unfortunate turn of events?

That question can be answered by building a Cause Map, a visual root cause analysis.  In the Cause Mapping process, the first step is to fill in an Outline with the background information for an issue as well as how the problem impacts the goals.  In this example, the aforementioned fetching impacts quite a number of goals: Safety as crowns were broken; environmental, the spilled di-hydrogen oxide; regulatory, child corporal punishment and child labor laws; customer service, no di-hydrogen oxide available for multiple purposes; production, the delay of supper; and labor, the time needed for medical attention.

Fortunately no property was lost as the well-made bucket survived intact.  Once we have filled out the Outline, the next step is to ask “why” questions to find the different causes that contributed to the problem being analyzed.

So why were they going up a hill? This presents us with a number of potential paths of exploration as to why the well was at the top of a hill. Even without knowing a detailed answer we know that a potential solution would be to get them hooked up an established di-hydrogen oxide system as soon as possible!

Why was there no protection? Broken crowns are a serious affair. This combined with the potential for other injuries from the fractious “tumbling down” incident leaves us to wonder how the well could be constructed in such a manner.

These are areas for further exploration. Even with the unanswered questions we are still able to propose several solutions to ensure that child labor laws are not ignored, hills are properly protected, and home remedies are carefully considered.

To view an Outline and a high level Cause Map for this issue, click on “Download PDF” above.