Tag Archives: accident

Root Cause Analysis - Incident Investigation

SL-1 Explosion-The Only Fatal Reactor Accident in the US

By ThinkReliability Staff

The only fatal reactor accident in the United States occurred on January 3, 1961, when an Army prototype known as SL-1 (for stationary, low power reactor, unit 1) exploded, killing the 3 operators who were present.  We’ll use the SL-1 tragedy as an example of how the Cause Mapping process can be applied to a specific incident.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The SL-1 tragedy killed the three operators present, which is an impact to the safety goal.  Another goal is that there be no damage to the vessel. In the case of SL-1, the  vessel sustained extensive damage.

The loss of life and vessel damage were both caused by the reactor exploding.  The reactor exploded because it went prompt critical (an uncontrollable, exponentially increasing fission reaction).  The reactor went prompt critical because withdrawal of the central rod can cause prompt criticality and because the rod was rapidly, manually lifted 26.4″ out of the core.

Withdrawal of the central rod can cause prompt criticality due to a lack of shutdown margin in the core, and inadequate safety criteria.

Because most of the evidence was so effectively destroyed, nobody really knows why the control rod was lifted out of the core.  There are two theories (disregarding the bizarre and improbable murder/suicide theory): 1) the control rod got stuck while being lifted to be attached to the drive mechanism, and, as the operator was exerting greater force on it, suddenly came free, resulting in a lift far greater than intended, or that an rod drop testing/exercising was performed improperly.

The control rod may have become stuck and came free while being attached because it was required to be lifted 4″ out of the core and because control rods had been sticking.  The control rods had been sticking for one or more of the following reasons: 1) reduced clearances due to radiation damage (which can cause structural material to swell), 2) the passage was blocked due to loss of poison strips in the channel, caused by poor design and inadequate testing, or 3) lifting equipment not working properly due to inadequate lifting capacity of the lifting equipment.

It’s also possible that an exercising/testing was potentially improperly performed.  This could have occurred because the operators chose to exercise/test the rods, attempting to ensure that they would perform properly, and because they didn’t realize what would happen. This is because of inadequate training and inadequate work instructions.  The testing was also potentially done improperly due to inadequate work instructions.

On a positive note, the SL-1 incident did initiate some positive changes in the nuclear industry.  Most notably, reactor design has improved and incorporated a “one-rod stuck” criteria which specifies that a reactor can NOT go critical by the removal of any one control rod.  Additionally, procedures and training have gotten more intense and more formal, and planning for emergencies has increased.

Root Cause Analysis - Incident Investigation

Navy Jet Crashes into Apartment Building

By Kim Smiley

On April 6, 2012, a Navy F-18 jet crashed into an apartment building in Virginia Beach, Virginia. Significant damage was done to the apartment building and the jet was destroyed, but amazingly no one was seriously injured or killed.

This incident can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  The first step when building a Cause Map is to determine how the incident affected the organizational goals.  The impacts to the organizational goals are recorded in the Outline which also documents the background information of the incident.  In this example, the safety goal was obviously impacted since there was potential for serious injuries.  The property goal was also impacted because the jet was destroyed and the apartment building suffered extensive damage.

Once the Outline is complete, “why” questions are asked to determine what factors contributed to the incident.  In this example, there was potential for injuries because a jet hit an apartment building.  This occurred because the jet was flying near the residential area and the jet was unable to complete its attempted take off.  The pilots could have been injured had they not been able to safety eject before the crash and there was potential for people on the ground to be injured since the jet crashed into a residential area. The jet crashed because it experienced a dual engine failure.  The investigation into this crash determined that that both engines failed for two separate, unrelated reasons.

The right engine failed because of a catastrophic failure of the engine compressor when it ingested flammable liquid that was ignited.  The left engine afterburner failed to light. Investigators believe that an electrical component failed, but the damage to the left engine was too severe for a conclusive determination of what exactly occurred.   According to the Navy, this is the first unrelated dual engine failure of a F-18.

The Navy plans to update procedures to incorporate the possibilities of this type of incident.

To view a high level Cause Map of this issue, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Deadly Kansas City Walkway Collapse

By Kim Smiley

On July 17, 1981, the second and fourth floor suspended walkways collapsed at the newly opened Hyatt Regency of Kansas City, Missouri.  A dance contest had attracted a crowd and the atrium under the walkway was filled with people.  This accident killed 113 people and injured 186.

The hotel was newly constructed and the walkways were well maintained.  So how did this happen?

A root cause analysis of this accident shows that there were a number of causes that contributed to the walkways collapsing.  Investigation into the accident shows that the structural design of the walkway was inadequate.  A weld failed which allowed a support rod to pull through the box beam and the walkways fell.

Additionally, the weld had greater stress than normal on it at the time of the failure because a large crowd had gathered to watch a danced content.  About 20 people were on second floor walkway and about 40 were on the fourth floor walkway at the time of the accident.  The higher loading combined to the walkway collapse.

Identifying the failure mechanism is important during an investigation, but a thorough root cause analysis needs to take the analysis farther to really understand the causes.  The reason that an inadequate design was built needs to be determined.

In this case, it appears that the design was changed without approval of the structural engineer.  This resulted from a communication error between the fabricator and the structural engineer.  The structural engineer sent a sketch of a proposed walkway design to the fabricator, assuming that the fabricator would work the details of the design himself. The fabricator assumed the sketch was a finalized drawing.   The fabricator then picked standard parts to fit the sketch.  This resulted in a significant change from the original design and dramatically decreased the load bearing capacity of the walkways.

The original design called for continuous hanger rods (a non-standard part that would have needed to be manufactured) that passed through the fourth floor walkway beam box to the second floor walkway, resulting in the ceiling connecting supporting the weight of both walkways.  The fabricator changed the design to use two shorter rods (standard parts) which resulted in the fourth floor walkway supporting the weight of the second floor walkway, which it wasn’t designed to handle.

It’s important to investigate beyond the point of inadequate design to learn what failed in the design process to prevent future accidents from occurring.

Root Cause Analysis - Incident Investigation

Deadly Plane Crash in Lagos, Nigeria

by ThinkReliability Staff

A devastating air crash in Lagos, Nigeria killed all on board and at least 10 on the ground.  This was the first major commercial air disaster since 2006.  Safety efforts since that disaster resulted in the US Federal Aviation Administration ( FAA) granting Nigerian    airlines its top air-safety rating.  Now concerns about air safety in Nigeria have resurfaced.  As a result of the crash, according to Harold Demuren, head of Nigerian civil aviation body: “We have suspended the entire Dana fleet.  They will be grounded as long as it takes to carry out the necessary investigations into whether they are airworthy.”

We can examine this incident in a Cause Map, or a visual root cause analysis.  We begin with the goals that were impacted.  In this case, the safety goal was impacted due to the deaths of people on the plane and on the ground.  We begin by asking “Why” questions to put together a very simple cause-and-effect relationship.  In this case, after losing both engines, Dana Air flight 992 crashed into a residential building in a highly populated suburb of Lagos, Nigeria, killing all 153 people on board and at least 10 on the ground.

The investigation of the plane crash is still ongoing.  However, it is known that both engines of the plane lost power, causing the plane to rapidly lose altitude and crash into a highly populated area.  Some of the areas being investigated that may have contributed to the crash are:

1) a bird strike (bird remains were found in one engine),

2) poor maintenance (although the plane was regularly inspected, there were also reports of leaking hydraulics and a history of poor airline safety in Nigeria, which appeared to have been remedied in recent years as indicated by the US FAA’s granting of its top air-safety rating,

3) overworked planes, likely due to financial considerations (the plane that crashed was on its fourth trip of the day), and/or

4) the age of the airplane (at 22 years old, it was technically not permitted to fly in Nigeria, which bans the use of planes over 20 years old).

As more information is revealed during the investigation it can be added to the Cause Map.  As the investigation is concluded, there will likely be more changes to Nigerian requirements and oversight for air safety.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Fire kills 146, Leads to Improved Working Conditions

By ThinkReliability Staff

146 workers were killed when a fire raced through the Triangle Company, which occupied the top three floors of a skyscraper in New York City.  The workers were unable to escape the fire.  We can examine this incident using a Cause Map, a visual form of root cause analysis, which allows us to diagram the cause-and-effect relationships that led to organizational issues – in this case, the death of 146 workers.

On March 25, 1911 at approximately 4:40 p.m., a fire began on the 8th floor of a New York City skyscraper (one of three floors housing the Triangle Waist Company).  Although it’s not clear what sparked the fire (cigarettes and sewing machine engines are likely heat sources), a large amount of accumulated scraps (last picked up in January) provided plenty of fuel.  There were no sprinklers and the interior fire hose was not connected to a water source.  The fire spread quickly and burned for approximately a half an hour before firefighters extinguished it.

During that half-hour, 146 workers, mostly young women, were killed.  Nearly all of these workers were from the 9th floor of the building.  Workers from the 8th and 10th floor were able to escape to the ground or roof using the stairs, but one of the access doors on the 9th floor was locked.  This left only one set of stairs and elevators, which did rescue many but were overcrowded and the elevator machinery eventually failed due to heat.  Many attempted to escape using the fire escape, which was not built for quick escape (in fact, experts determined it would take 3 hours to reach ground from the Triangle Company floors) and eventually collapsed due to the collective weight, killing those on it in the fall.

Many workers jumped from the 9th floor, but the force of the fall was too great for the fire nets, which mainly broke and the jumpers died.

People were horrified at the conditions in the factories that resulted in these deaths.  In the following years, public outcry resulted in many workers’ rights improvements, including many advances in regulations regarding fire protection and working conditions.  However, these types of issues continue in other countries that have not defined such requirements.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more

Root Cause Analysis - Incident Investigation

113 Killed When a Plane Hit a Hill in Guadeloupe

By ThinkReliability Staff

Flying into a small airport surrounded by mountains at night, in a thunderstorm, with virtually no support from ground equipment proved to be too difficult for even an experienced pilot.

All 113 passengers and crew on Air France Flight 117 were killed when the plane crashed into a hill near the airport in Point-à-Pitre, Guadeloupe on June 22, 1962. The crash occurred in the early morning hours, during a severe thunderstorm.   We can examine the causes of this tragedy in a Cause Map, a visual form of root cause analysis that shows the cause-and-effect relationships that led to an incident  such as this one.  The VHF (very high frequency) omnidirectional range (VOR) indicator, which helps aircraft determine position and stay on course, at the airport in Guadeloupe was not functional.  (It’s not clear if the crew of the Air France flight was aware of this, or how long the equipment had been broken.)  The plane in question was a Boeing 707.

The safety goal was impacted because all people onboard the plane – passengers and crew – were killed.  The plane (valued at $5.5 million) was completely destroyed.  The lack of a working VOR, and the incorrect information provided by the  Automatic direction finder (ADF) can be considered impacts to the customer service goal.  Beginning with the impacted safety goal, we can ask “Why” questions to begin mapping cause-and-effect relationships.   The passengers and crew were killed (and the plane destroyed) when the plane crashed into a hill.

The plane crashed into a hill because the airport was surrounded by mountains, and the plane strayed off the let down track, which it should have used for its approach to the airport.  The pilot went off track because he was using a visual approach, probably due to the fact that the VOR was not providing data since it was not working.   The pilot was unable to see the track due to low (10 km) visibility and since it was early morning (~4 a.m.).  In addition, the plane received incorrect position indication from the ADF, which appeared to malfunction as a result of the severe thunderstorm in the area.

This incident resulted in concern from pilots of substandard landing conditions at certain airports.  More care is now taken with take-off and landing during inclement weather, poor visibility, or conditions that result in landing with decreased equipment support.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Deadly Sawmill Explosion

By ThinkReliability Staff

An explosion and subsequent fire at a sawmill in British Columbia has killed two workers and injured two dozen more.  Although the cause of the explosion is not known, there have been five explosions linked to wood dust in British Columbia since 2009.

A dust explosion results from the presence of combustible dust, such as that created by the sawmilling process.  In order for an explosion to occur, the dust must be dispersed into the air but confined by a structure in the presence of oxygen and a spark.  (Learn more about dust explosions.) 

To view all the causes that contributed to this tragic explosion, we can examine the incident in a Cause Map, or visual root cause analysis.  We begin with the impacts to the goals. The employee deaths and injuries are an impact to the safety goal.  This is the primary focus of any issue that results in human death or injury.  In addition, the environmental goal was impacted as the smoke migrated to the nearby town.  The production goal was impacted due to the shutdown of the facility.  The property goal was impacted due to destruction of the sawmill, log processing facility, and sorting facility.  Lastly, the investigation and cleanup will impact labor goals.

Once we have determined the impacts to the goals, we can ask why questions to determine the cause-and-effect relationships that led to the incident.  In this case, the injuries were due to the fire.  The fire may have been caused by a dust explosion (explosion due to natural gas leak has been ruled out).  In order for a dust explosion to occur, five factors are necessary: 1) presence of combustible dust, 2) oxygen, 3) dust is dispersed into the air, 4) dust particles are confined, and 5) the mixture is ignited.

In this case, the ignition source is not known and, due to the damage at the facility, may never be conclusively determined.  Similarly, the cause that resulted in the dust being dispersed may also not be known.  The oxygen must be present for worker safety and the dust is confined because it is held within a closed structure.  The dust is present because it is created during sawmilling operations.  What makes a dust combustible depends on the properties of the dust.  This mill was processing pine beetle wood, or wood that was ravaged by beetles.  This makes the wood drier, which results in a drier, finer, more combustible dust.  Thorough cleaning of any facility that creates potentially combustible dust is a necessity – inadequate cleaning (including dust that may gather on hard-to-access surfaces, such as the ceiling) increases the possibility of an explosion.  The union believes that cleaning has been reduced as a result of the economy.

Local government has begun inspections of saw mills but are asking plants to examine potential dust and ignition sources. Reducing dust and ignition sources are the most effective way to reduce risk of dust explosions.  Other solutions being considered include adding water to the air to increase humidity and increased ventilation, which can reduce the confinement of the dust and increase cleanliness.

To view the Outline and Cause Map, please click “Download PDF” above.

 

Root Cause Analysis - Incident Investigation

School Leveled by Gas Explosion

By Kim Smiley

On March 18, 1937, the London School of New London, Texas was leveled by a huge explosion.  Unfortunately, many people were in the school on the afternoon of the explosion and an estimated 280 students, 15 teachers, 2 visitors and a school secretary were killed.  This tragedy remains the worst catastrophe to occur inside a school in American history.

The cause of this tragic incident can be investigated by building a Cause Map, a visual root cause analysis, which shows the cause and effect relationships between the different factors that contributed to the explosion.  A Cause Map begins by determining which goals were impacted and in this example the safety goal is the obvious focus.  Causes are then added to the Cause Map by asking “why” questions to add additional information.  In this example, the safety goal was impacted by the large number of fatalities.  The deaths occurred because the school was occupied and the school was destroyed.

The school was destroyed because there was a large natural gas explosion.  The explosion occurred because there was a large quantity of natural gas in the school and a shop teacher turned on a sander and created a spark.  The gas was in the school because there was a leak, there was a large quantity of gas was trapped in a void space under the school and the gas leak wasn’t detected.  The investigation into this incident was never able to decisively determine what caused the natural gas leak.  The void space was under the school because the school was built on a slope.  The leak wasn’t detected because the school was using untreated natural gas which is both invisible and odorless.

Why was the school using untreated natural gas?  The school was trying to save money by eliminating their heating bill.  The school was located near oil fields and had tapped into a nearby residue gas line to provide heat, saving approximately $300 dollars a month.  Using free untreated natural gas was a common practice in the region.  The gas company turned a blind eye since natural gas was considered a waste product of oil drilling that was just flared off.

The end result of using free, but untreated natural gas was that no one could detect that the school was filled with natural gas.  One spark and the whole school was destroyed along with many, many lives.

As a result of this horrendous accident, all natural gas in the United States is treated to have an odor, usually with mercaptan which smells like rotten eggs, so that leaks can be detected by smell.

Root Cause Analysis - Incident Investigation

Girder Fell on Car, Killing 3

by Kim Smiley

On May 15, 2004, a girder fell off an overpass and hit a car driving on the road below, killing all three occupants of the vehicle.  The National Transportation Safety Board (NTSB) investigated the incident to determine what caused the fatal accident.  The findings from the investigation can be used to build a Cause Map, a visual root cause analysis, which illustrates the causes that contributed to the accident.

In this example, the girder hit the car because it fell from an overpass and the car was driving on the road below it.  The girder was temporarily installed on the overpass because it was being used to add two additional lanes to the overpass.  The work was being performed at night in effort to minimize the impact on the heavy traffic that normally used the roads involved.  The workers believed the girder attached to the overpass was in a safe condition so they had opened the road beneath it to traffic.

The girder fell because it was inadequately fastened to the overpass.  The NTSB determined that the girder wasn’t installed plumb to the bridge and it was inadequately bolted to the bridge which allowed the girder to twist and ultimately fall.  The investigation also determined that the girder was inadequately fastened because the project wasn’t planned well.  The original work plan called for two girders to be spliced together and then fastened to the bridge, but a delay in work meant that the subcontractor was only able to get one girder up before the work was halted to allow the roads to be opened for morning rush hour.  (Weather delays postponed the work further and the single girder was fastened to the bridge for several days prior to falling.) There were also no Professional Engineers involved in the planning and no formal drawings created of how one girder would be fastened to the bridge.

The NTSB investigation also determined that the guidance that governed bracing was inadequate.  The language used was confusing and there was a lack of consistent standards.  The oversight of the contractor’s work was also inadequate since the inspector did not notice that the girder wasn’t secured adequately.

As a result of this investigation, the NTSB made several specific suggestions to revise bracing standards to improve clarity.

To view a high level Cause Map of this incident, click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Prison Fire Kills 103 in 2009

By Staff

On February 9, 2009, a fire and explosion in a seriously overcrowded prison in Honduras resulted in 103 deaths and 25 injuries.  The fire was started from a short circuit from a overheated refrigerator motor, used to store soft drinks for the inmates.  The cell block – which has a capacity of 800 – contained 1960 inmates, their clothing, and their bedding materials.  This provided plenty of fuel for the fire.

We can look at the causes that led to the prisoner deaths in a Cause Map, or visual root cause analysis.  We begin with the impacts to the goals.  The deaths and injuries of prisoners are an impact to the safety goal.  The environmental goal was impacted by the severe prison fire and explosion.  The customer service goal (considering the general population as the “customer” of a government-run prison) was unaffected, as there were no prisoner escapes.  Finally, the property goal was impacted due to damage to the prison.

We can continue the Cause Map by asking “why” questions.  The impacts to the goals were due to a severe prison fire and explosion.  In addition to the fire, the injuries to the prisoners was caused by the prisoners being unable to escape.  Part of the reason the prisoners were unable to escape is because they are in prison, and so precautions against escape are part of the deal.  However, egress from a building that is on fire to a safe location should be part of the procedures of any prison.  In this case, the procedures obviously didn’t work considering the high amount of deaths and injuries (of a total of 186 prisoners in this cell block).  The egress was likely made more   difficult due to severe prison overcrowding.  The prison has a capacity of 800 and contained 1,960 prisoners.  The increase in the prison population is at least partially due to a legislation passed the previous August which mandated a minimum 12-year prison term for gang members.  There are estimated to be more than 100,000 gang members in Honduras.

The heat for the fire was provided by an overheating refrigerator motor.  The fuel was provided by large amounts of clothing and bedding materials – more than usual, due to the prison overcrowding.

Once the causes for the impacted goals have been determined, solutions can be brainstormed.  In this case, prisoner advocates have been long calling for alternatives to jail sentences for gang members.  This would, of course, reduce the prison population.  Another option to reduce prison overcrowding would be to build more prisons.  To reduce the risk of fire, motorized equipment should be kept away from flammable objects, like clothing and bedding.  Last but not least, any facility has to have an effective egress plan in the case of fire or other emergencies.  These procedures are especially important in the case of a prison, where the potential of prisoner escape has to be considered as well as prisoner safety.

To view the root cause analysis investigation, please click “Download PDF” above.  Or click here to read more.