Tag Archives: accident

Root Cause Analysis - Incident Investigation

Changing the Emergency Response Process

By ThinkReliability Staff

When Line 132 ruptured last September in the community of San Bruno, California, emergency personnel were quick to respond to the natural gas explosion.  The first fire truck was on scene within six minutes of the explosion.  What responders found was a chaotic scene, with multiple wounded and killed and swaths of the neighborhood in flames or simply flattened.  Little did they know that a large natural gas transmission line, feeding the spreading fire, was directly beneath them.  Emergency personnel did their best to clear homes and evacuate the wounded as the fire spread, but the confusion continued for nearly 90 minutes until the gas valves were shut off upstream from the fire.

The subsequent National Transportation Safety Board (NTSB) investigations focused on Pacific Gas and Electric (PG&E) processes following the accident, and found that PG&E was woefully unable to respond quickly to a crisis of this magnitude.  As a set of timelines show, emergency response personnel were already on scene long before PG&E was even aware that a pipeline rupture may be associated with a local fire.  PG&E apparently did not notice an alarm warning them of a pressure drop.  Control systems detected a severe pressure drop approximately four minutes after the disruption; however the PG&E gas control center, located in San Francisco, remained unaware of the explosion and fire until a PG&E dispatch center in Concord called them.  Off duty employees had called-in to the Concord dispatch center 7 and 11 minutes after the incident, alerting them of a large fire in San Bruno.  However it was not until the dispatch center called the gas control center 16 minutes after the explosion that gas control operators realized what was happening.  By this point emergency responders had already arrived at the scene, unaware of the large natural gas pipeline directly under the neighborhood.

What information did emergency responders have as they arrived on scene that day?  Although PG&E itself was aware of the likely service disruption, they failed to notify first responders of any potential danger in those critical minutes after the explosion.  Additionally according to NTSB testimony, the fire department was unaware of the large natural gas pipeline under the community.  Larger transmission pipelines have different operating characteristics than smaller distribution pipelines, including different recommended safety precautions and shut down times.  With a better awareness of the pipeline locations and associated dangers, emergency response personnel could have developed training and response procedures ahead of time for an explosion of this magnitude.  PG&E has since taken steps to enhance its partnership with first responders and other public safety organizations.  Clearly there are other steps that need to be taken as well.

When conducting an investigation, a timeline can be a helpful tool to organize information.  While straightforward to build, timelines can identify areas needing more research and aid in building a process map and a Cause Map.  Compare what happened at PG&E to what emergency responders were doing.  You’ll notice there was a significant delay at PG&E in recognizing there was a problem and then acting upon it.  It took nearly 90 minutes to close valves to shut transmission lines.  Changes must be made to speed up PG&E’s procedures in a crisis situation.

Likewise process maps are a useful tool for determining where a process can use improvement.  In the Current process map, it is noticeable that there are three parallel processes occurring, where information is not being shared in an efficient manner.  The PG&E Dispatch Center only shares information with the Emergency Dispatch Center after they have fully assessed the situation.  This information might come after the fact, as it did in San Bruno, or seriously delay an effective response by EMTs and firefighters.  Going one step further, trained emergency personnel might be able to check with local utilities if they have reason to suspect a natural gas pipeline is involved.  Simple procedural changes, such as who is notified and when, can have significant impacts.

It is important to note that the timeline helps create the most accurate “As Occurred” process map (called Current in this case).  Procedures can differ from actual processes, so it is important to document what actually happened, identify differences in what should have occurred, and figure out why it didn’t.  In this case, PG&E’s procedures were followed and need to be revised.

The NTSB recommendations will undoubtedly lead to multiple changes.  It is easy to focus on material solutions, which tend to be expensive to implement.  Some changes under consideration are the use of remote controlled valves and the replacement of aging pipes.  While there is no doubt that these changes need to happen, other changes can help in the meantime.  Process maps can help identify procedural changes which may be much less expensive, such a modifying notification procedures.

A detailed Cause Map built after the preliminary investigation shows what NTSB investigators believe led the natural gas leak.  More information on the NTSB investigation can be found here.

Root Cause Analysis - Incident Investigation

Issues at Fukushima Daiichi Unit 3

By ThinkReliability Staff

There are many complex events occurring with some of Japan’s nuclear power plants as a result of the earthquake and tsunami on March 11, 2011.  Although the issues are still very much ongoing, it is possible to begin a root cause analysis of the events and issues.  In order to clearly show one issue, our analysis within this blog is limited to the issues affecting Fukushima Daiichi Unit 3.  This is not to minimize the issues occurring at the other plants and units, but rather to clearly demonstrate the cause-and-effect within one small piece of the overall picture.

The issues surrounding Unit 3 are extremely complex.  In events such as these, where many events contribute to the issues, it can be helpful to make a timeline of events.  A timeline of the events so far can be seen by clicking “Download PDF” above.  A timeline can not only help to clarify the order of contributing events, it can also help create the Cause Map, or visual root cause analysis.  To show how the events on the timeline fit into the Cause Map, some of the entries are denoted with numbers, which are matched to the same events on the Cause Map.  Notice that in general, because Cause Maps build from right to left with time, earlier entries are found to the right of newer events.  For example, the earthquake was the cause of the tsunami, so the earthquake is to the right of the tsunami on the map.  Many of the timeline events are causes, but some are also solutions.  For example, the venting of the reactor is a solution to the high pressure.  (It also becomes a cause on the map.)

A similar analysis could be put together for all of the units affected by the earthquake, tsunami and resulting events.  Parts of this cause map could be reused as many of the issues affecting the other plants and units are     similar to the analysis shown here. It would also be possible to build a larger Cause Map including all impacts from the earthquake.

The impact to goals needs to be determined prior to building a Cause Map. As a direct result of the events at Unit 3, 7 workers were injured.  This is an impact to the worker safety goal.  There is the potential for health effects to the population, which is an impact to the public safety goal.  The environmental goal was impacted due to the release of radioactivity into the environment.  The customer service goal was impacted due to evacuations and rolling blackouts, caused by the loss of electrical production capacity, which is an impact to the production goal.  The loss of capacity was caused by catastrophic damage to the plant, which is an impact to the property goal.  Additionally, the massive effort to cool the reactor is an impact to the labor goal.

The worker safety and property goals were impacted because of a hydrogen explosion, which was caused by a buildup of pressure in the plant, caused by increasing reactor temperature.  Heat continues to be generated by a nuclear reactor, even after it is shutdown, as a natural part of the operating process.  In this case, the normal cooling supply was lost when external power lines were knocked down by the tsunami (which was caused by the earthquake).  The tsunami also apparently damaged the diesel generators which provided the emergency cooling system.  The backup to the emergency cooling supply stopped automatically and was unable to be restarted, for reasons that are as yet unknown.

The outline, timeline and cause map shown on the PDF are extremely simplified.  Part of this simplification is due to the fact that as the event is still ongoing and not all information is known, or has been released. Once more information becomes available, it can be added to the analysis, or the analysis can be revised.

To learn more about the reactor issues at Fukushima Daiichi, view our video summary.  To see a blog about the impact of the fallout on the health of babies in the US, see our healthcare blog.

Root Cause Analysis - Incident Investigation

Deadly Tiger Attack

By Kim Smiley

On December 25, 2007, a tiger escaped her enclosure at the San Francisco Zoo and attacked three people.  One 17 year old boy was killed and the other two were injured. The enclosure was built in the 1940s and had safely contained tigers for more than 60 years without incident.

So how did this happen?  How did the tiger escape?

A Cause Map can be built using this example to help determine how this incident was able to occur. To begin a Cause Map, the impacts to the organizational goals are first determined and then “why” questions are asked to add causes to the map.  In this case, there was obviously an impact to the safety goal because one zoo patron was killed and two were injured.  The customer service goal was also impacted because the zoo was closed until January 3, 2008 following the incident.  Why was a zoo patron killed?  He was killed because he was mauled by a tiger.  Why was he mauled?  Because the tiger escaped her enclosure and she went after the victims.

Let’s focus on the question of how the tiger escaped her enclosure first.  An investigation was conducted by the United States Department of Agriculture’s Animal and Plant Health Inspection Service, the government body who is charged with overseeing the nation’s zoos.  Based on claw marks and other evidence at the scene, they determined that the tiger jumped from the bottom of a dry moat and was able to pull herself over the fence surrounding her enclosure.  The investigation also determined the fence was lower than typically used around tiger enclosures.  The Association of Zoos & Aquariums recommends that walls around a tiger exhibit be at least 16.4 feet and the fence around the San Francisco Zoo was only 12.5 feet at the time.

The second question of why the tiger went after the boys is not as easy to answer.  A few experts have stated that the tiger didn’t behave in a typical way.  There has been significant speculation in the media that the victims taunted the tiger or provoked her in some way, but nothing has ever officially been determined.

This focus on the behavior of the victims is a good example of some of the issues that can come up during an investigation.  It can be tempting to focus on assigning blame when investigating an incident.  But the real question is “What should we do to prevent this from happening again?”.  Whether or not the boys provoked the tiger, she should never have been able to escape her enclosure.

After the incident, the zoo extensively remodeled the tiger enclosure, adding a much higher fence and with hotwire at the top to prevent any similar incidents from occurring.

Root Cause Analysis - Incident Investigation

The Phillips 66 Explosion: Planning for Emergencies

By ThinkReliability Staff

All business strive to make their processes as efficient as possible and maximize productivity.  Minimizing excess inventory only seems sensible, as does placing process equipment in a logical manner to minimize transit time between machines.  However, when productivity consistently takes precedence over safety, seemingly insignificant decisions can snowball when it matters most.

Using the Phillips 66 explosion of 1989 as an example, it is easy to see how numerous efficiency-related decisions snowballed into a catastrophe.  Examining different branches of the Cause Map highlights areas where those shortcuts played a role.  Some branches focus on how the plant was laid out, how operations were run and how the firefighting system was designed.  Arguably, all of these areas were maximized for production efficiency, but ended up being contributing factors in a terrible explosion and hampered subsequent emergency efforts.

For instance, the Cause Map shows that the high number of fatalities was caused not just by the initial explosion.  The OSHA investigation following the explosion highlighted contributing factors regarding the building layout.  The plant was cited for having process equipment located too closely together, in violation of generally accepted engineering practices.  While this no doubt maximized plant capacity, it made escape from the plant difficult and did not allow adequate time for emergency shutdown procedures to complete.  Additionally high occupancy structures, such as the control room and administrative building were located unnecessarily close to the reactors and storage vessels.  Luckily over 100 personnel were able to escape via alternate routes.  But luck is certainly not a reliable emergency plan; the plant should have been designed with safety in mind too.

Nearby ignition sources also contributed to the speed of the initial explosion, estimated to be within 90 to 120 seconds of the valve opening.  OSHA cited Phillips for not using due diligence in ensuring that potential sources of ignition were kept a safe distance from flammable materials or, alternatively, using testing procedures to ensure it was safe to bring such equipment into work zones.  The original spark source will never be known, but the investigation identified multiple possibilities.  These included a crane, forklift, catalyst activator, welding and cutting-torch equipment, vehicles and ordinary electrical gear.   While undoubtedly such a large cloud of volatile gas would have eventually found a spark, a proactive approach might have provided precious seconds for workers to escape.  All who died in the explosion were within 250 feet of the maintenance site.

Another factor contributing to the extensive plant damage was the inadequate water supply for fire fighting, as detailed in the Cause Map.  When the plant was designed, the water system used in the HDPE process was the same one that was to be used in an emergency.  There is no doubt a single water system was selected to keep costs down.  Other shortcuts include placing regular-service fire system pump components above ground.  Of course, the explosion sheared electrical cords and pipes controlling the system, rending it unusable.  Not only was the design of the fire system flawed, it wasn’t even adequately maintained.  In the backup diesel pump system, only one of three pumps was operational; one was out of fuel and the other simply didn’t work.  Because of these major flaws, emergency crews had to use hoses to pump water from remote sources.  The fire was not brought under control until 10 hours after the initial explosion.  As the Cause Map indicates, there may not have been such extensive damage had the water supply system been adequate.

There is a fine line between running processes at the utmost efficiency and taking short-cuts that can lead to dangerous situations.  Clearly, this was an instance where that line was crossed.

Root Cause Analysis - Incident Investigation

Residential Natural Gas Explosion

By ThinkReliability Staff

The town of Allentown, Pennsylvania suffered severe physical and emotional damage on February 9, 2011, when 5 people were killed and 8 homes were completely destroyed.  The deaths and destruction were believed to be caused by a natural gas explosion, fueled by a 12″ gas main break.  In addition to the impacts to the safety and property goals, the natural gas leak, extended fire, and time/labor by 53 responders also impacted goals.

We can analyze the causes of these impacts to the goals with a visual root cause analysis.  Beginning with the impacts to the goals, we ask why questions to determine the causes that contributed to the incidents.  In this case, there was a delay in putting out the fire because the fire had a heat source from the explosion, a constant oxygen source (the environment) and a steady supply of fuel, as the natural gas continued to leak.  There was no shut-off valve to quickly stop the flow of gas.  It took the utility company 5 hours to finally turn off the gas.  It took 12 more  hours before the fire was completely put out.

The fuel for the explosion and the fire is believed (according to the utility company) to have come from a break discovered in the 12″ gas main.  A 4′ section of pipe, removed on February 14th, is being sent for a forensic analysis to aid in determining what may have contributed to the crack.  It’s possible there was prior damage – such as that from weather or prior excavations.  Most of the pipe in the area was installed in the 1950s, although some is believed to be from the 1920s.  Budget shortfalls have delayed replacing, or even inspecting the lines in the area, and officials have warned that continuing financial issues may continue to delay inspections and improvements,  causing concern with many residents, who suffered a similar natural gas pipeline explosion in 1994.

Because implementation of potential solutions to improve the state of the utility lines in the area may be limited by available funding, it’s unclear what will be done to attempt to reduce the risk of a similar incident in the future.   However, the unacceptability of resident casualties should stir some action so that this doesn’t happen again.

Root Cause Analysis - Incident Investigation

The Phillips 66 Explosion: The Rise of Process Safety Management in the Petrochemical Industry

By ThinkReliability Staff

Many of the industrial safety standards that we take for granted are the direct result of catastrophes of past decades.  Today there are strict regulations on asbestos handling, exposure limits for carcinogens, acceptable noise levels, the required use of personal protective equipment, and a slew of other safety issues.  The organization charged with enforcing those standards is the Occupational Health and Safety Administration – OSHA for short.

OSHA was founded in 1970, in an effort to promote and enforce workplace safety, and their stated mission is to “assure safe and healthful working conditions for working men and women”.  However, there was considerable controversy during its early years as it spottily began enforcing, what was perceived as, cumbersome and expensive regulations.  Notable events in the 1980s, such as the Bhopal and West Virginia Union Carbide industrial accidents, raised OSHA’s awareness that fundamental changes were needed to develop more effective safety management systems.

This awareness led to the rise of what is now known as Process Safety Management (PSM).  This discipline covers how industries safely manage highly hazardous chemicals.  OSHA’s PSM standard lays forth multiple requirements such as employee and contractor training, use of hot work permits, and emergency planning.  Unfortunately PSM was still a work-in-progress during the fall of 1989.

On October 23, 1989, the Phillips 66 Petroleum Chemical Plant near Pasadena, Texas, then producing approximately 1.5 billion of high-density polyethylene (HDPE) plastic each year, suffered a massive series of explosions.  23 died and hundreds were injured in an explosion that measured at least 3.5 on the Richter scale and destroyed much of the plant.  Many of the deficiencies identified at the Phillips 66 plant were in violation of OSHA’s PSM directives; directives which had been announced, but had not yet been formally enacted.

Looking at the Phillips 66 Explosion Cause Map, one can see how a series of procedural errors occurred that fateful day.  Contract workers were busy performing a routine maintenance task of clearing out a blockage in a collection tank for the plastic pellets produced by the reactor.  The collection tank was removed, and work commenced that morning.  However, at some point just after lunch, the valve to the reactor system was opened, releasing an enormous gas cloud which ignited less than two minutes later.

The subsequent OSHA investigation highlighted numerous errors.  First, the air hoses used to activate the valve pneumatically were left near the maintenance site.  When the air hoses were connected backwards, this automatically opened the valve, releasing a huge volatile gas cloud into the atmosphere.  It is unknown why the air hoses were reconnected at all.  Second, a lockout device had been installed by Phillips personnel the previous evening, but was removed at some point prior to the accident.  A lockout device physically prevents someone from opening a valve.  Finally, in accordance with local plant policy but not Phillips policy, no blind flange insert was used as a backup.  The insert would have stopped the flow of gas into the atmosphere if the valve had been opened.  Had any of those three procedures been executed properly, there would not have been an explosion that day.  According to the investigation, contract workers had not been adequately trained in the procedures they were charged with performing.

Additionally, there were significant design flaws in the reactor/collector system.  The valve system used had no mechanical redundancies; the single Demco ball valve was the sole cut-off point between the highly-pressurized reactor system and the atmosphere.  Additionally, there was a significant design flaw with the air hoses, as alluded to earlier.  Not only were the air hoses connected at the wrong time, but there was no physical barrier to prevent them from being connected the wrong way.  This is the same reason North American electrical plugs are mechanically keyed and can only be plugged in one way.  It can be bad news if connected incorrectly!  Connecting the air hoses backward meant the valve went full open, instead of closed.  Both of these design flaws contributed to the gas release, and again, this incident would not have occurred if either flaw was absent.

In hindsight, one can see how multiple problems led to such devastating results.  To easily understand the underlying reasons behind the Phillips 66 Explosion of 1989, a high-level Cause Map provides a quick overview of the event.  Breaking a section of the Cause Map down further can provide significant insight into the multiple reasons the event occurred.  The associated PDF for this case shows how different levels of a Cause Map can provide just the right amount of detail for understanding a complex problem such as this one.

The Phillips 66 explosion was a tragedy that could have been avoided.  The industrial safety standards that OSHA is charged with enforcing aim to prevent future tragedies like this one.  While a gradual safety-oriented transformation has come with some pain and a price tag, few will argue that such standards are unnecessary.  Industrial workers deserve to work in an environment where risk to their health has been reduced to the most practical level.

Root Cause Analysis - Incident Investigation

Aging Natural Gas Pipeline Finally Fails

By ThinkReliability Staff

Few ever contemplate the complex system of utilities surrounding us.  The beauty of our modern standard of living is that usually there is little reason to think about those things.  Those rare cases where power isn’t available at the flip of a switch, or fresh water at the turn of a faucet usually make the local news.

Sadly, the community of San Bruno was faced with much more than simple inconvenience.  On September 9, 2010, an explosion ripped through the suburban community, ultimately killing 8 and destroying or damaging 100 homes.  The explosion was caused by a ruptured natural gas pipeline, and it appears that a slight increase in pipe pressure led to the final failure.  That change in pressure resulted from a glitch in maintenance procedures at a pipeline  terminal.  While ultimately that glitch may have been the “straw that broke the camel’s back”, it is clear from the Cause Map analysis that the straw pile was already fairly high.

Based on National Transportation Safety Board reports, both poor pipe construction and inadequate record-keeping played a major role in the failure.  The pipes, at or near their life expectancy, were already considered too thin by the 1950s’ standards when they were originally installed.  Furthermore improperly done welding made the pipes susceptible to corrosion.  Compounding these issues was the fact that PG&E, the utilities company responsible the pipeline, wasn’t even aware that the San Bruno pipeline had such extensive welding.  This matters because gas pressures are calculated based on a number of inputs, including the construction of the pipeline.  Even that slight increase in pressure proved to be more than the aging pipe could handle.

Natural gas pipelines are fairly extensive in the United States, and with suburban sprawl many communities live close to these pipelines.  In fact, many states have already taken steps to prevent similar events from occurring in their community.  Multiple utilities companies have been mandated to install newer pipelines, as in Texas and Washington.  Additionally, the federal government requires that newly constructed pipelines must be inspected by “smart pigs” – robots able to maintain and inspect pipeline systems.  However, modernizing this aging infrastructure will be expensive for many communities.

Perhaps there are easy, inexpensive interim solutions available.  The Cause Map analysis identifies all causes leading to the explosion, and then provides a systematic method for developing solutions.  Hopefully some of the solutions generated will prevent future disasters, like the one in San Bruno.

Root Cause Analysis - Incident Investigation

More Info about Deadly Mine Explosion

By Kim Smiley

Around 3 pm on April 5, 2010 in Montcoal, West Virginia, a huge explosion rocked the Upper Big Branch South mine killing 29 (Click here to read previous blog on the topic).  The toxic gas concentration in the mine remained so high after the accident that Mine Safety and Health Administration investigations were not able to enter the mine for more than two months after the accident.  The final report is still two to three months away, but the MSHA has developed a working theory on what caused the mine explosion.

According to a recent NPR article, investigators believe they have found the source of the spark that started the chain of events that lead to the massive mine explosion.  A longwall mining machine was in operation inside the mine, creating sparks as it ate through both coal and sandstone.  Sparking may have been worse than usual because investigators found that the carbide tipped teeth on the machine were worn down so that bare metal was contacting the stone and coal.

Sparks are expected during these types of operations so a water sprayer system is typically used to prevent explosions from occurring, but investigations found the water system in Upper Big Branch was not functioning properly.  Additionally, a properly functioning water spray system would help control the amount of coal dust in the air.  Coal dust is an accelerant, which means it will contribute to an explosion if ignited.

Another cause of this accident is the level of methane gas in the environment.  The Upper Big Branch South mine is a particularly gassy mine that naturally emitted high levels of methane gas.  There are still some open questions about the role ventilation may have played in the accident.

Small ignitions of methane gas are not uncommon in coal mines, but large explosions are rare.  According to data collected by Mine Safety and Health News, about 600 ignitions have occurred in the past 10 years without any major mine explosions occurring.

Coal mining involves managing a tricky combination of coal dust, methane and sparks.  Usually, no one gets hurt, but in this case the mixture resulted in a massive explosion that traveled more than two miles inside the mine and claimed the lives of 29.  Performing a thorough root cause analysis can help investigators understand what was different in this case and hopefully help the lessons learned be applied to other mines.

As more information comes available, the Cause Map can be expanded to include all relevant details.  Click “Download PDF” above to view the intermediate level Cause Map for this example.

Root Cause Analysis - Incident Investigation

Toxic Red Sludge Spill

By Kim Smiley

On Monday, October 4, 2010, a massive wave of red sludge flooded into four villages near Kilontar, Hungary when a storage reservoir burst.  Four were killed and at least 150 have needed medical treatment for their injuries.  The most common injuries reported are burns and eye ailments.

Red sludge is a highly caustic material that is produced during the aluminum manufacturing process.  Reports indicate that the sludge had a pH of 13 while stored in the reservoir.  All life has been killed in a 25 mile stretch of river and 16 square miles of land have been covered by the pollution.  Best estimates are that 158 million to 184 million gallons of sludge were released.  This first large scale release of red sludge in history.

Hungary’s top investigative agency is looking into the accident, but the cause for the reservoir barrier failure is not known at this time.

Even with the unknowns, a root cause analysis can be started by creating a Cause Map and documenting all available information.  Any new information can easily be incorporated into the existing Cause Map.

To build a Cause Map, we start with the impacted goals and ask “why” questions.  In this example, the two goals we will consider are the Safety goal and the Environmental goal.  Starting with the Safety goal we begin by asking – Why were people injured?  They were injured because they were exposed to caustic material because red sludge flooded into their villages.  Why?  Because red sludge was stored in a nearly reservoir and the barrier on the reservoir was breached.

Why the barrier failed isn’t known, but we can still add additional information that might be useful.  We know that the red sludge reservoir was near the villages and a little research reveals that this is common practice in the region and that there are a number of similar pools nearby.  This information may become relevant if the investigation determines that the other reservoirs are at risk for a similar failure so it’s worth recording on our Cause Map at this point. There is also information available about the environmental impact that can be added.

The investigation is still incomplete, but the Cause Map can grow as more information comes available.  Once the relevant information is added, the Cause Map can be used to develop solutions to help prevent similar accidents from occurring in the future.

Root Cause Analysis - Incident Investigation

Dig Deeper to get to the Causes of the Oil Spill

By ThinkReliability Staff

On Sunday (September 26th, 2010) the lead investigator for the Deepwater Horizon oil spill was questioned by a National Academy of Engineering committee.  The committee brought up concerns that the investigation that had been performed was not adequate to address all the causes of the spill.  Said the lead oil spill investigator: “It is clear that you could go further into the analysis . . . this does not represent a complete penetration into potentially deeper issues.”

Specifically, the committee was concerned that the study focused on decisions made on the rig (generally by personnel who worked for other companies) but did not adequately consider input from these companies.  The study also avoided organizational issues that may have contributed to the spill.

In circumstances such as this one – where an extremely complicated event requires an organization to spend most of its resources fixing the immediate problem, an interim report – which may not delve deeply into underlying organizational issues or obtain a full spectrum of interviews – may be appropriate.  However, it’s just an interim report and should not be treated as the final analysis of the causes relating to an issue.  The organizations involved need to ensure that after the immediate actions – stopping the spill, completing the cleanup, and compensating victims – are complete, an in-depth report commensurate with the impact of the issue is performed.

In instances such as these, causes relating to an incident need to be unearthed ruthlessly and distributed freely.  This is generally why a governmental organization will perform these in-depth reviews.  The personnel involved in the investigation must not be limited to only one organization, but rather all organizations that are involved in the incident.  Once action items that will improve safety and processes have been determined, they must be freely distributed to all other organizations participating in similar endeavors.  The alternative – to wait until similar disasters happen at other sites – is unacceptable.