Tag Archives: aircraft incident

Uncategorized

How Did a Cold War Nuclear Bomb Go Missing?

By ThinkReliability Staff

Is there a nuclear bomb lost just a few miles off the coast of Savannah, Georgia? It seems that we will never know, but theories abound. While it is easy to get caught up in the narrative of these theories, it is interesting to look at the facts of what actually happened to piece together the causes leading up to the event. This analysis may not tell us if the bomb is still under the murky Wassaw Sound waters, but it can tell us something about how the event happened.

Around 2 am on February 5, 1958, a training exercise was conducted off the coast of Georgia. This was during the most frigid period of the Cold war, and training was underway to practice attacking specific targets in Russia. During this particular training mission, Major Howard Richardson was flying a B-47 bomber carrying a Mark 15, Mod 0 Hydrogen bomb containing 400 pounds of conventional explosives and some quantity of uranium.

The realistic training mission also included F-86 ‘enemy’ fighter jets. Unfortunately, one of those jets, piloted by Lt. Clarence Stewart, did not see the bomber on his radar and accidentally maneuvered directly into the B-47. The damage to both planes was extensive. The collision destroyed the fighter jet, and severely damaged the fuel tanks, engine, and control mechanisms of the bomber.   Fortunately, Stewart was able to safely eject from the fighter jet. Richardson had a very difficult quest ahead of him: to get himself and his co-pilot safely on the ground without detonating his payload in a heavily damaged aircraft. He flew to the closest airfield; however, the runway was under construction, making the landing even more precarious for the two crew members and for the local community that would have been affected had the bomb exploded upon landing. Faced with an impossible situation, Richardson returned to sea, dropped the bomb over the water, observed that no detonation took place, and returned to carefully land the damaged bomber.

The Navy searched for the bomb for over two months, but bad weather and poor visibility did not make the search easy. On April 16, 1958, the search was ended without finding the bomb. The hypothesis was that the bomb was buried beneath 10 – 15 feet of silt and mud. Since then, other searches by interested locals and the government have still not identified the location of the bomb.   In 2001, the Air Force released an assessment which suggests two interesting points. First, the bomb was never loaded with a ‘detonation capsule’, making the bomb incapable of a nuclear explosion. (Until this time, conventional wisdom suggested that the detonation capsule was included with the bomb.) Second, the report concluded that it would be more dangerous to try to move the bomb than to leave the bomb in its resting place.

While we may never learn the location of the bomb, we can learn from the incident itself. Using a Cause Map, we can document the causes and effects resulting in this incident, providing a visual root cause analysis. Beginning with several ‘why’ questions, we can create a cause-effect chain. In the simplest Cause Map, the safety goal was impacted as a result of the danger to the pilots and to the nearby communities as the result of a potential nuclear bomb explosion. This risk was caused by the bomb being jettisoned from the plane, which was a result of the collision between the fighter jet and the bomber. The planes collided due to the fact that they were performing a training mission to simulate a combat scenario.

More details are uncovered as this event is further broken down to include more information and to document the impact to other goals. The property goal is impacted through the loss of aircraft and the bomb. The bomb is missing because it was jettisoned from the bomber AND because it was never found during the search. The bomb was jettisoned because the pilot was worried that the bomb might break loose during landing. This was due to the fact that the planes collided. The planes collided due to the fact that the F-86 descended onto the top of the B-47 AND because they were in the midst of a training exercise. The fighter jet crashed into the bomber because the bomber was not on radar. The planes were performing an exercise because they were simulating bombing a Russian target, because it was the middle of the Cold War. The search was unsuccessful because the bomb is probably buried deep in the mud AND because the weather and visibility were bad during the search.

Finally, the ‘customer service’ goal is impacted by the fact that the residents in nearby communities are nervous about the potential danger of explosion/radiation exposure. This nervousness is caused by the fact that the bomb is still missing AND the fact that the bomb contained radioactive material, which was due to routine protocol at the time.

Evidence boxes are a helpful way to add information to the Cause Map that was discovered during the investigation. For example, an evidence box stating the evidence from the 2001 Air Force report that the bomb had no detonation capsule has been added to the Cause Map. A Cause Map is a useful tool to help separate the facts from the theories. Click on “Download PDF” above to see the full, detailed Cause Map.

Root Cause Analysis - Incident Investigation

Component Failure & Crew Response, Not Weather, Brought Down AirAsia Flight QZ8501

By Staff

Immediately following the December 28, 2014 crash of AirAsia flight QZ8501, severe weather in the area was believed to have been the cause of the loss of control of the plane. (See our previous blog on the crash.) However, recovery of the “black box” and a subsequent investigation determined that it was a component failure and the crew’s response to the upset condition that resulted in the crash and that weather was not responsible. This is an example of the importance of gathering evidence to support conclusions within an investigation.

Says Richard Quest, CNN’s aviation correspondent, “It’s a series of technical failures, but it’s the pilot response that leads to the plane crashing.” Because, as in common in these investigations, there is a combination of causes that resulted in the crash, it can help to lay out the cause-and-effect relationships. We will do this in a Cause Map, a visual form of root cause analysis. The Cause Map is built by beginning with an impact to the goals, such as the safety goal, and asking why questions.

The 162 deaths (all on board) resulted from the plane’s rapid (20,000 feet per minute) plunge into the sea. According to the investigation, the crash resulted from an upset/ stall condition AND the crew’s inability to recover from that condition. Because both of these causes contributed to the crash, they are both connected to the effect (crash) and separated with an “AND”.

More detail can be added to each “leg” of the Cause Map by continuing to ask “why” questions. The prolonged stall/ upset condition resulted from the aircraft being pushed beyond its limits. (It climbed 5,400 feet in about 30 seconds.) This occurred because of manual handling and because of the failure of the rudder travel limiter system, which is designed to restrict rudder movement to a safe range. The system failed due to a loss of electrical continuity from a cracked solder joint on a circuit board. Although maintenance records showed 23 complaints with the system in the year prior to the crash, it was not repaired. A former pilot and member of the investigation team stated it was considered “minor damage” and was “not a concern”.

The plane was being manually controlled because the autopilot and autothrust were disengaged. These systems were disengaged when a circuit breaker was reset (removed and replaced) to attempt to reset the system after a computer system failure (indicated by four alarms that sounded in the cockpit). While this is sometimes done on the ground, it shouldn’t be done in the air because it disengages the autopilot and autothrust systems. However, the crew had inadequate upset recovery training. According to the manual from the manufacturer the aircraft is designed to prevent it from becoming upset and therefore training is not necessary. The decision to manually place the plane in a steep climb is believed to have been an attempt to get out of the poor weather. Just prior to the crash, the less experienced co-pilot was at the controls.

The lack of crew training on upset conditions is also believed to have caused the crash. In addition, for at least some time prior to the crash, the pilot and co-pilot were working against each other by pushing their control sticks in opposite directions. The pilot was heard on the voice recorder calling for them to “pull down”, although “pulling” is used to bring the plane up.

The only recommendation that has so far been released is for commercial pilots to undergo flight simulator training for this type of emergency situation. AirAsia has already done so. The company, as well as the aviation industry as a whole, will hopefully look at the conclusions of the investigation report with a very critical eye towards improving safety.

Uncategorized

Runway Fire Forces Evacuation of Airplane

By ThinkReliability Staff

On September 8, 2015, an airplane caught fire during take-off from an airport in Las Vegas, Nevada. The pilot was able to stop the plane, reportedly in just 9 seconds after becoming aware of the fire. The crew then evacuated the 157 passengers, 27 of whom received minor injuries as a result of the evacuation by slide. Although the National Transportation Safety Board (NTSB) investigation is ongoing, information that is known, as well as potential causes that are under consideration, can be diagrammed in a Cause Map, or visual root cause analysis.

The first step of Cause Mapping is to define the problem by completing a problem outline. The problem outline captures the background information (what, when and where) of the problem, as well as the impact to the goals. In this case, the safety goal is impacted due to the passenger injuries. The evacuation of the airplane impacts the customer service goal. The NTSB investigation impacts the regulatory goal. The schedule goal is impacted by a temporary delay of flights in the area, and the property goal is impacted by the significant damage to the plane. The rescue, response and investigation is an impact to the labor goal.

The Cause Map is built by beginning with one of the impacted goals and asking “Why” questions to develop the cause-and-effect relationships that led to an issue.   In this case, the injuries were due to evacuation by slide (primarily abrasions, though some sources also said there were some injuries from smoke inhalation). These injuries were caused by the evacuation of the airplane. The airplane was evacuated due to an extensive fire. Another cause leading to the evacuation was that take-off was aborted.

The fact that take-off was able to be aborted, for which the pilot has been hailed as a hero, is actually a positive cause. Had the take-off been unable to be aborted, the result would likely have been far worse. In the case of the Concorde accident, a piece of debris on the runway ruptured a tire, which caused damage to the fuel tank, leading to a fire after the point where take-off could be aborted. Instead, the aircraft stalled and crashed into a hotel, killing all onboard the craft and 4 in the hotel. The pilot’s ability to quickly save the plane almost certainly saved many lives.

The fire is thought to have been initiated by an explosion in the left engine due a catastrophic uncontained explosion of the high-pressure compressor. This assessment is based on the compressor fragments that were found on the runway. This likely resulted from either a bird strike (as happened in the case of US Airways flight 1549), or a strike from other debris on the runway (as occurred with the Concorde), or fatigue failure of the engine components due to age. This is the first uncontained failure of this type of engine, so some consider fatigue failure to be less likely. (Reports of an airworthiness directive after cracks were detected in weld joints of compressors were in engines with different parts and a different compressor configuration.)

In this incident, the fire was unable to be put out without assistance from responding firefighters. This is potentially due to an ongoing leak of fuel if fuel lines were ruptured and the failure of the airplane’s fire suppression system, which reportedly deployed but did not extinguish the fire. Both the fuel lines and fire suppression system were likely damaged when the engine exploded. The engine’s outer casing is not strong enough to contain an engine explosion by design, based on the weight and cost of providing that strength.

The NTSB investigation is examining airplane parts and the flight data and cockpit voice recorders in order to provide a full accounting of what happened in the incident. Once these results are known, it will be determined whether this is considered an anomaly or whether changes to all planes using a similar design and configuration need to take action to prevent against a similar event recurring.

To view the initial investigation information on a one-page downloadable PDF, please click “Download PDF” above.

 

Uncategorized

Crash of Germanwings flight 95252 Leads to Questions

By ThinkReliability Staff

On March 24, 2015, Germanwings flight 9525 crashed into the French Alps, killing all 150 onboard. Evidence available thus far suggests the copilot deliberately locked the pilot out of the cockpit and intentionally crashed the plane. While evidence collection is ongoing, because of the magnitude of this catastrophe, solutions to prevent similar recurrences are already being discussed and, in some cases, implemented.

What is known about the crash can be captured in a Cause Map, or visual form of root cause analysis. Visually diagramming all the cause-and-effect relationships allows the potential for addressing all related causes, leading to a larger number of potential solutions. The analysis begins by capturing the impacted goals in the problem outline. In this case, the loss of 150 lives (everybody aboard the plane) is an impact to the safety goal and of primary concern in the investigation. Also impacted are the property goal due to the loss of the plane, and the recovery and investigation efforts (which are particularly difficult in this case due to the difficult-to-access location of the crash.)

Asking “Why” questions from the impacted goals develops cause-and-effect relationships. In this case, the deaths resulted from the crash of the plane into the mountains of the French Alps. So far, available information appears to support the theory that the copilot deliberately crashed the plane. Audio recordings of the pilot requesting re-entry into the cockpit, the normal breathing of the co-pilot, and the manual increase of speed of the descent while crash warnings sounded all suggest that the crash was deliberate. Questions have been raised about the co-pilot’s fitness for duty. Some have suggested increased psychological testing for pilots, but the agency Airlines for America says that the current system (at least in the US), is working: “All airlines can and do conduct fitness-for-duty testing on pilots if warranted. As evidenced by our safety record, the U.S. airline industry remains the largest and safest aviation system in the world as a result of the ongoing and strong collaboration among airlines, airline employees, manufacturers and government.”

Some think that technology is the answer. The flight voice recorder captured cockpit alarms indicating an impending crash. But these were simply ignored by the co-pilot. If flight guidance software was able to take over for an incapacitated pilot (or one who deliberately ignores these warnings, disasters like this one could be avoided. Former Department of Transportation Inspector General Mary Schiavo says, “This technology, I believe, would have saved the flight. Not only would it have saved this flight and the Germanwings passengers, it would also save lives in situations where it is not a suicidal, homicidal pilot. It has implications literally for safer flight across the industry.”

Others say cockpit procedures should be able to prevent an issue like this. According to aviation lawyers Brian Alexander & Justin Green, in a blog for CNN, “If Germanwings had implemented a procedure to require a second person in the cockpit at all times – a rule that many other airlines followed – he would not have been able to lock the pilot out.”

After 9/11, cockpit doors were reinforced to prevent any forced entry (according to the Federal Aviation Administration, they should be strong enough to withstand a grenade blast). The doors have 3 settings – unlock, normal, and lock. Under normal settings, the cockpit can be unlocked by crewmembers with a code after a delay. But under the lock setting (to be used, for example, to prevent hijackers who have obtained the crew code from entering the cockpit), no codes will allow access. (The lock setting has to be reset every 5 minutes.) Because of the possibility a rogue crewmember could lock out all other crewmembers, US airlines instituted the rule that there must always be two people in the cockpit. (Of course, if only a three-person crew is present, this can cause other issues, such as when a pilot became locked in the bathroom while the only other two flight crew members onboard were locked in the cockpit, nearly resulting in a terror alert. See our previous blog on this issue.)

James Hall, the former chairman of the National Transportation Safety Board, agrees. He says, “The flight deck is capable of accommodating three pilots and there shouldn’t ever be a situation where there is only one person in the cockpit.” In response, many airlines in Europe and Canada, including Germanwings’ parent company Lufthansa, have since instituted a rule requiring at least two people in the cockpit at all times.   Other changes to increase airline safety may be implemented after more details regarding the crash are discovered.

Root Cause Analysis - Incident Investigation

TransAsia Plane Crashes into River in Taiwan

By Kim Smiley

On February 4, 2015, there were 53 passengers onboard TransAsia Airways Flight 235 when the plane crashed into the Keelung River shortly after taking off from the Taipei Shonshan Airport.  There were 15 survivors from this dramatic crash where the plane hit a bridge and taxi cab prior to turning upside down before hitting the river. (The crash was caught on video by dash cameras from a vehicle on the bridge and can be seen here.)

Investigators are still working to determine exactly what happened, but some early findings have been released.  The plane involved in this crash was a turboprop with two engines.  This model of plane can fly safely with only one engine, but both engines had issues immediately prior to the crash so the pilots were unable to control the plane.

Data from the flight recorder shows that the right engine idled 37 seconds after takeoff.  No details about what caused the problem with the right engine have been made available.  The initial investigation findings are that the left engine was likely manually shut down by the pilots.  It’s not clear why the functioning engine would have been intentionally shut down. Early speculation is that it was a mistake and that the pilots were attempting to restart the idled right engine when they hit the switch for the operating left engine.

The investigation into the crash is ongoing and the final report isn’t expected to be released for about a year, but based on the initial findings, a few solutions to help reduce the likelihood of future crashes have already been implemented.  TransAsia has grounded most of its turboprop aircraft pending additional pilot instruction and requalification because it is believed that pilot action may well have contributed to the deadly accident.  More than 100 domestic flights have been canceled as a result.  Additionally, Taiwan’s Civil Aeronautic Administration has announced that the carrier will be banned from adding new international routes for 12 months.  A previous crash in July 2014 had already tarnished TransAsia’s reputation and this latest disaster will certainly be scrutinized by the authorities.

An initial Cause Map, a visual root cause analysis, can be built to analyze the information that is available on this crash and to document where there are still open questions.  To view a Cause Map and Outline of this incident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Can Airline Seats Get Even Smaller?

By Kim Smiley

Was the experience the last time you flew wonderful?  Did you enjoy all the luxurious amenities like ample elbow room, stretching out your legs, and turning around in the bathroom?  Me neither.  Comfort certainly hasn’t been the top priority as airlines have shrunk seats to cram more passengers onboard, but a new patent application by Airbus really takes things to a whole new level.

They say that a picture is worth a thousand words and I think that is particularly true in this case.  This is a diagram of a patent application for a proposed seat design –

 

I’m not sure about the rest of you, but my backside is sore just thinking about an airplane seat that bears such a strong resemble to a bicycle.

I attempted to build a Cause Map, a visual root cause analysis, in order to better understand how such a design could be proposed because I frankly find it mind-boggling.  The basic idea is that airlines would like to maximize profits and that putting more people on each flight allows more tickets to be sold resulting in more money made.  The average airline seat width has already decreased to about 17 inches from the 18 inches typical for a long-haul airplane seat in the 1970s and 1980s.  Compounding the impact on passengers is the fact that the average passenger has increased during that same time frame.  In general larger bodies are being put in smaller seats, not a recipe for a comfort.

I’m still having a hard time understanding how the correct answer to increasing airline profits is making seats even smaller.  I have to believe that passengers will balk at some point.  At some level of discomfort, a cheap ticket just won’t be cheap enough for me to be willing to endure a truly awful flight.  Even with electronic distractions and snacks, there has to be a point where people would just say no.

There also has to be a number of safety concerns that arise when the size of airplane seats is dramatically decreased.  Survivability in a crash is greatly influenced by seat design because airplane seats are designed to absorb energy and provide head injury protection during an accident.

Just to be clear, there is no plan to actually use this seat design anytime in the near future.  This is just a patent application.  As Airbus spokeswoman, Mary Anne Greczyn said, “Many, if not most, of these concepts will never be developed, but in case the future of commercial aviation makes one of our patents relevant, our work is protected. Right now these patent filings are simply conceptual.” But somebody somewhere still thought this was a good enough idea that it should be patented…just in case.

Root Cause Analysis - Incident Investigation

Why Can’t the Missing Malaysia Airliner be Found?

By Holly Maher

On March 8, 2014 Malaysia Airline flight MH370 took off from Kuala Lumpur heading for Beijing, China.  The aircraft had 239 passengers and crew aboard.  Less than 1 hour into the flight, communication and radar contact was lost with the aircraft.  Forty-nine days later, the location and fate of the aircraft is still unknown despite a massive international effort to locate the missing airliner.  The search effort has dominated the news for the last month and the question is still out there: how, with today’s technology, can an entire aircraft go missing?

Since we may never know what happened to flight MH370, this analysis is intended to understand why we can’t find it and identify the causes required to produce this effect.  This will allow us to identify many possible solutions for preventing it from happening again.  We start by asking “why” questions and documenting the answers to visually lay out all the causes that contributed to this incident.  The cause-and-effect relationships lay out from left to right.

In this example, the Customer Service Goal is impacted because we are missing 239 passengers and crew.  This is caused by the fact that we can’t locate Malaysia Airline MH370.  The inability to locate the airline is a result of a number of causes over the 49 day period.  One reason is that 3 days were initially spent looking in the wrong location, along the original flight path from Kuala Lumpur to Beijing, in the Gulf of Thailand and the South China Sea.  The reason 3 days were mistakenly spent looking in this location is that the airline had left the original flight path and officials were unaware of that fact.  Why the aircraft left the original flight path is still unknown, but we can look at some of the causes that allowed the flight to leave the original flight path undetected.

One of the reasons the aircraft was able to leave the original flight path undetected was that air traffic control was unable to track the airplane with radar. The transponder onboard the aircraft, which allows the ground control to track the aircraft using airspeed and altitude, was turned off less than one hour into the flight.  We don’t know the reason the transponder was turned off; however, the fact that it is designed to be turned off manually is a cause of the transponder being turned off.  It is designed to be manually turned off to reduce risk in the event of failure or fire, and to reduce radio traffic when the airplane is on the ground.  After 9/11, when 3 out of the 4 hijacked airplanes had transponders that had been turned off, the airline industry debated the manual on/off design of the transponder, but aviation experts strongly supported the need for the pilots to be able to turn off the transponders, as needed, for the safety of the flight.

Another reason the aircraft left the original flight path undetected was because the flight crew outside the cockpit did not communicate distress or change of route.  This is because all communications from the airplane come from/through the cockpit.  The aircraft is not currently equipped to allow for communication, specifically distress communications, from outside the cockpit.

Days into the investigation, radar data was identified which showed the change of course of the aircraft.  This changed the area of the search away from the original flight path.  However, this radar detection was not identified in real time, as the plane was moving away from the original flight path.  This is also a cause of the aircraft being able to leave the flight path undetected.

Once the search area moved west, the size of the potential search area was incredibly large, another cause of being unable to locate the aircraft.  At its largest, the search area was 2.96 million square miles.  This was based on an analysis of how far the flight could have gotten with the amount of fuel on board.  Further analysis of satellite data, or “handshakes” with the computer framework on board the aircraft, continued to refine the search area.

Many people have asked why no one on the flight made cell phone calls indicating distress (if this was an act of terrorism).  The reason no cell phone calls were made was because cell phones do not work over 2000 ft.  That is because there is no direct line to a cellular tower.

Another cause of being unable to locate MH370 is being unable to locate the black box.  The black box is made of aluminum and is very heavy, designed to withstand significant forces in the event of a crash.  This causes the black box to sink, instead of float, making it difficult to locate.  The depth of the ocean in which the search is occurring ranges from 4,000-23,000 ft, adding to the difficulty of finding the black box.  Acoustic pings were last detected from the black box on April 8, 2014, 32 days into the search.  This is because the battery life on the black box is ~30 days.  This had been the battery design life criteria prior to the Air France Flight 447 crash in 2009.  It took over 2 years to locate the black box and wreckage from flight 447, therefore the design criteria for the black box battery life was changed from 30 days to 90 days.  This would allow search crews more time to locate the black box.  Malaysia Airlines Flight MH370 still had a black box with a battery life of 30 days.

Once the analysis has broken down incident into its causes, solutions can be identified to mitigate the risk a similar incident in the future.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

Root Cause Analysis - Incident Investigation

Pilot Response to Turbulence Leads to Crash

By ThinkReliability Staff

All 260 people onboard Flight 587, plus 5 on the ground, were killed when the plane crashed into a residential area on November 12, 2001.  Flight 587 took off shortly after another large aircraft.  The plane experienced turbulence.  According to the NTSB, the pilot’s overuse of the rudder mechanism, which had been redesigned and as a result was unusually sensitive, resulted in such high stress that that vertical stabilizer separated from the body of the plane.

This event is an example of an Aircraft Pilot Coupling (APC) event.  According to the National Research Council, “APC events are collaborations between the pilot and the aircraft in that they occur only when the pilot attempts to control what the aircraft does.  For this reason, pilot error is often listed as the cause of accidents and incidents that include an APC event.  However, the [NRC] committee believes that the most severe APC events attributed to pilot error are the result of the adverse APC that misleads the pilot into taking actions that contribute to the severity of the event.  In these situations, it is often possible, after the fact, to analyze the event carefully and identify a sequence of actions the pilot could have taken to overcome the aircraft design deficiencies and avoid the event.  However, it is typically not feasible for the pilot to identify and execute the required actions in real time.”

This crash is a case where it is tempting to chalk up the accident to pilot error and move on.  However, a more thorough investigation of causes identifies multiple issues that contributed to the accident and, most importantly, multiple opportunities to increase safety for future pilots and passengers.  The impacts to the goals, causes of these impacts, and possible solutions can be organized visually in cause-and-effect relationships by using a Cause Map.  To view the Outline and Cause Map, please click “Download PDF” above.

The wake turbulence that initially affected the flight was due to the small separation distance between the flight and a large plane that took off 2 minutes prior (the required separation distance by the FAA).  This led to a recommendation to re-evaluate the separation standards, especially for extremely large planes.  In the investigation, the NTSB found that the training provided to pilots on this particular type of aircraft was inadequate, especially because changes to the aircraft’s flight control system rendered the rudder control system extremely sensitive.  This combination is believed to be what led to the overuse of the rudder system, leading to stress on the vertical stabilizer that resulted in its detachment from the plane.  Specific formal training for pilots based on the flight control system for this particular plane was incorporated, as was evaluation of changes to the flight control system and requirements of handling evaluations when design changes are made to flight control systems for   previously certified aircraft. A caution box related to rudder sensitivity was incorporated on these planes, as was a detailed inspection to verify stabilizer to fuselage and rudder to stabilizer attachments.  An additional inspection was required for planes that experience extreme in-flight lateral loading events.  Lastly, the airplane upset recovery training aid was revised to assist pilots in recovering from upsets such as from this event.

Had this investigation been limited to a discussion of pilot error, revised training may have been developed, but it’s likely that a discussion of the causes that led to the other solutions that were recommended and/or implemented as a result of this accident would not have been incorporated.  It’s important to ensure that incident investigations address all the causes, so that as many solutions as possible can be considered.

Root Cause Analysis - Incident Investigation

The Deadliest Airship Crash in History Wasn’t the Hindenburg

By Kim Smiley

Many people have heard of the Hindenburg, but have you heard of the USS Akron?  The Hindenburg crashed in 1937, killing 35 people. The USS Akron crash four years earlier killed 73, making it the deadliest airship crash in history.

The crash of the USS Akron can be investigated by building a Cause Map, a visual format for performing a root cause analysis.  A Cause Map is built by asking “why” questions to determine what causes contributed to an issue.  The causes are organized on the Cause Map to illustrate the cause-and-effect relationships between them.  Why were 73 people killed?  This occurred because they were onboard the USS Akron, the airship struck the ocean surface, the crew had little time to brace for impact and there were insufficient flotation devices onboard.

The crew was onboard the USS Akron because the airship was operated by the US Navy and was performing a routine mission at the time of the crash.  The airship hit the ocean because it was operating over the ocean and lost altitude in a severe storm.  Why was the airship operating in a storm?  There was no severe weather predicted at the time and a low pressure system unexpectedly developed.  The crew had little time to brace for the impact because they weren’t aware that an impact was imminent.  There was low visibility at the time because it was a stormy, dark night. The barometric altimeter was also showing that the airship was higher than it actually was.  Barometric altimeters are affected by pressure and the low pressure in the storm impacted more than the crew realized.   The lack of life jackets and other floatation devices also contributed to the high number of deaths.  There were no life jackets onboard the airship at the time of the crash and only one rubber raft.  The safety equipment had been given to another airship and had never been replaced.

While few of us plan to operate or build an airship anytime in the near future, the important of keeping sufficient safety gear onboard any vehicle of any kind is an important lesson.  Lack of safety gear is a reoccurring theme in many historical disasters.  For example, the sinking of the Titanic would be a very different story if there had been sufficient lifeboats onboard.  This example might be very different if the crew had been wearing life jackets.  The airship would still have been lost, but there would likely have been fewer casualties.

To view a high level Cause Map of this example, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Hindenburg Crash: The Importance – and Difficulty – of Validating Evidence

By ThinkReliability Staff

Since the Hindenburg explosion in 1937, theories have abounded on what caused the leaking gas and spark that doomed the airship and dozens of passengers.  We discussed some of these theories in our previous blog on the Hindenburg disaster.

In December, 2012, a documentary on the Discovery Channel used new evidence to discuss the most likely cause of the disaster.  Yep, that’s right.  76 years after the original explosion, evidence is still being gathered to help determine what really caused the explosion that killed 36 people.

Sometimes evidence is relatively easy to gather – many pieces of equipment now feed into automatic data collectors, which can provide reams of data about what happened for a specific period of time.  Sometimes, however, evidence is much harder to come by. This is especially the case with fires or explosions which frequently destroy much of the available evidence.

When evidence is hard to come by, it is difficult to determine the exact cause-and-effect relationships that led to an incident.  The best we may be able to do is capture different possibilities in a Cause Map, or visual root cause analysis, and leave the causes that haven’t been validated by evidence as possible causes, indicated by a question mark.

Sometimes, determining the exact cause(s) is important enough to result in painstaking efforts like those performed by a team at the South West Research Institute.  The team created three 1/10-scale models, not a small undertaking when the scale models are over 80 feet in length and is inflated with 200 cubic meters of hydrogen.  They then replicated scenarios described by the various theories by setting fire to, and blowing up, the models.  Additionally, they studied archive footage and eyewitness accounts to increase their understanding of the disaster.

As a result, the team now believes they have determined what happened.  Says Jem Stansfield, an aeronautical engineer and the project lead, “I think the most likely mechanism for providing the spark is electrostatic.”   The spark ignited leaking hydrogen, caused by a broken tensioning wire that punctured a gas cell or a sticking gas valve.

View the updated investigation with the recently released evidence incorporated by clicking “Download PDF” above.

Read our detailed writeup on the Hindenburg investigation.

Or, click here to read more from the blog of the on-air historian and technical advisor to the project (some really cool photos of making and destroying the models are included).