Tag Archives: Cause Mapping

911 Outage in Baltimore

By Kim Smiley

Nobody ever wants to find themselves in the position of dialing 911.  But imagine how quickly a bad situation could get even worse if nobody answered your call for emergency help.  That is exactly what happened on July 16, 2016 to people in Baltimore, Maryland.  For about two hours, people dialing 911 in Baltimore got a busy signal.

This incident can be investigated by building a Cause Map, a visual root cause analysis.  A Cause Map intuitively lays out the many causes that contributed to an issue to show all the cause-and-effect relationships.  By focusing on the multiple causes, rather than a single root cause analysis, the range of solutions considered is naturally widened.

The first step in the Cause Mapping process is to fill in an Outline with the basic background information for the incident.  Additionally, the Outline is used to capture how the incident impacts the overall goals.  This incident, like most incidents, impacted more than one goal.  For example, the safety goal is impacted because of the delay in emergency help and the customer service goal is impacted because people were unable to reach 911 operators.

The bottom line on the Outline is used to note the frequency of similar incidents.  This is important because an incident that has occurred 12 times before may warrant a different level of investigation than an isolated incident.  For this example, newspapers reported a previous 911 outage in June in the Baltimore area. The outages appear to have been caused by different issues, but do raise questions about the overall stability of the 911 system in Baltimore. Investigators should determine if the multiple outages are related and indicative of bigger issues than just this one incident.

Once the Outline is completed, the Cause Map itself is built by asking “why” questions.  So why was there a 911 outage for about 2 hours? Newspapers have reported that the outage occurred because of electrical power failures after both the main and back-up power systems shut down.  The power systems shut down because of a malfunctioning air conditioning unit.  No details have been released about exactly why the air conditioning units malfunctioned, but additional information could quickly be added to the Cause Map as it becomes known.

The final step in the Cause Mapping process is to develop and implement solutions to reduce the risk of the problem reoccurring. The investigation into this incident is still ongoing and no information about potential long-term solutions has been announced. In the short term, callers were asked to dial 311 or call their closest fire station or police district station if they heard a busy signal or were otherwise unable to get through to 911.  It is probably not a bad idea for all of us to have the numbers of our local fire and police stations on hand, just in case.

Train Derails on Track Just Inspected

By ThinkReliability Staff

A train derailment in the Columbia River Gorge near Mosier, Oregon resulted in a fire that burned for 14 hours. The Federal Railroad Administration (FRA) preliminary investigation says the June 3rd derailment was caused by a broken lag bolt which allowed the track to spread, resulting in the 16-car derailment. Although there is only one other known instance of a broken lag bolt causing a train derailment, the FRA determined that the bolt had been damaged for some time, and had been inspected within days of the incident, raising questions about the effectiveness of these inspections.

Determining all the causes of a complex issue such as a train derailment can be difficult, but doing so will provide the widest selection of possible solutions. A Cause Map, or visual root cause analysis, addresses all aspects of the issue by developing cause-and-effect relationships for all the causes based on the impacts to an organization’s goals. We can create a Cause Map based on the preliminary investigation. Additional causes and evidence can be added to the map as more detail is known.

The first step in the Cause Mapping process is to determine the impacts to the organization’s goals. While there were no injuries in this case, the massive fire resulting from the derailment posed a significant risk to responders and nearby citizens, an impact to the safety goal. The release of 42,000 gallons of oil (although much of it was burned off in the fire) is an impact to the environmental goal. The customer service goal is impacted by the evacuation of at least 50 homes and the regulatory goal is impacted by the potential for penalties, although the National Transportation Safety Board (NTSB) has said it will not investigate the incident. The state of Oregon has requested a halt on oil traffic, which would be an impact to the schedule goal. The property goal is impacted by the damage to the train cars, and the labor/ time goal is impacted by the response and investigation.

The analysis, which is the second step in the Cause Mapping process, begins with one of the impacted goals and develops cause-and-effect relationships by asking ‘Why’ questions. In this case, the safety goal is impacted by the high potential for injuries. This is caused by the massive fire, which burned for 14 hours. There may be more than one cause resulting in an effect, such as a fire, which is caused by heat, fuel, and oxygen. The oxygen in this case is from the atmosphere. The heat source is unknown but could have been a spark caused by the train derailment. The fire was fueled by the 42,000 gallons of crude released due to damage to train cars, which were transporting crude from the Bakken oil fields, caused by the derailment.

The derailment of 16 cars of the train was caused by the broken lag bolt. Any mechanical failure, such as a break, results from the stress on that object exceeding the strength of the object. In this case, the stress was caused by the weight of the 94-car train. The length of a train carrying crude oil is not limited by federal regulations. The strength of the bolts was reduced due to previous damage, which was not identified prior to the failure. While the track strength is evaluated every 18 months by the Gauge Restraint Measurement System (GRMS), it did not identify the damage. It’s unclear the last time it was performed.

Additionally, although the track is visually inspected twice a week by the railroad, it is done by vehicle, which would have made the damage harder to spot. The FRA does not require walking inspections. Nor does the FRA inspect or review the railroad’s inspections very often – there are less than 100 inspectors for the 140,000 miles of track across the country. There are only 3 in Oregon.

As a result of the derailment, the railroad has committed to replacing the existing bolts with heavy-duty ones, performing GRMS four times a year, enhanced hyrail inspections and visual track inspections three times a week, and performing walking inspections on lag curves monthly.

The FRA is still evaluating actions against the railroad and is again calling for the installation of advanced electronic brakes, or positive train control (PTC). It has also recommended PTC after other incidents, such as the deaths of two railroad workers on April 3 (see our previous blog) and the derailment in Philadelphia last year that killed 8 (see our previous blog).

To view a one-page PDF of the Cause Mapping investigation, click on “Download PDF” above. Or, click here to read the FRA’s preliminary investigation.

FAA Proposes Amazon Fine for Hazardous Shipment

By Kim Smiley

The Federal Aviation Administration (FAA) recently proposed fining Amazon $350,000 for shipping a product that allegedly violated hazardous materials regulations. The package in question was shipped by Amazon from Louisville, Kentucky, to Boulder, Colorado and contained a one-gallon container of corrosive drain cleaner with the colorful name Amazing! LIQUID FIRE. During transit, the package leaked and 9 UPS workers were exposed to the drain cleaner and reported a burning sensation. The workers were treated with a chemical wash and experienced no further issues, but this incident highlights issues with improper shipment of hazardous materials.

A Cause Map, a visual root cause analysis, can be built to analyze this issue by visually laying out the cause-and-effect relationships that contributed to the issue.  The first step in the Cause Mapping method is to fill in an Outline.  The top part of the Outline lists the basic background information for the issue, such as the date and time.  The bottom portion of the Outline has a section to list how the problem impacts the overall goals of the organization.  Most problems have more than one impact and this incident is no exception.  For example, the safety goal is impacted because workers were exposed to hazardous chemicals and the regulatory goal is impacted because of the FAA investigation and the proposed fine.

The frequency of the issue is listed on the last line of the Outline.  Identifying the frequency is important because an issue that has occurred a dozen times may likely warrant a more detailed investigation than an issue that has been reported only once.  For this example, Amazon has had at least 24 hazardous materials violations between February 2013 and September 2015 so the concerns about improperly handling hazardous materials goes beyond the issues with this one package.

Once the Outline is completed, the Cause Map is built by starting at one of the impacted goals and asking “why” questions. Starting at the safety goal for this example, the first question would be “why were workers exposed to hazardous chemicals?”. This happened because the workers were handling a package containing hazardous chemicals, a package containing hazardous chemicals leaked, and inadequate precautions were taken to prevent the workers being exposed to the chemicals. When there is more than one cause that contributes to an effect, the causes are listed vertically and separated by an “and”.

To continue building the Cause Map, ask “why” questions for each of the causes already listed. The workers were handling the package because it shipped by air via UPS. Inadequate precautions were taken to prevent exposure to the chemical because workers were unaware that package contained hazardous chemicals. Chemicals leaked because they were not properly packaged.  Why questions should continue to be asked until no more information is known or no useful detail can be added to the Cause Map. To view an intermediate level Cause Map of this issue with more information, click on “Download PDF” above.

The final step in the Cause Mapping process is to use the Cause Map to develop and implement solutions to reduce the risk of the problem reoccurring. More information about what exactly led to improperly packaged and labeled hazardous materials being shipped would be needed to develop useful solutions in this example, but hopefully a fine of this size and the negative publicity it generated will help spark efforts to make improvements.

Marauding Monkeys Lead to Electrical Outage in Kenya

By ThinkReliability Staff

One monkey managed to cause an electrical outage for all of Kenya – 4.7 million households and businesses – for 15 minutes to more than 3 hours. In order to determine solutions to prevent this from happening again, a thorough analysis of the problem is necessary. We will look at this issue within a Cause Map, a visual form of root cause analysis.

The first step of any problem-solving method is to define the problem. In the Cause Mapping method, the problem is defined with respect to the organization’s goals. In this case, there were several goals that were impacted. If the organization has a goal of ensuring safety of animals, that goal is impacted due to the risk of a fatality or severe injury to the monkey. (In this case, the monkey was unharmed and was turned over to the wildlife service.) The loss of power to 4.7 million businesses and households is an impact to the customer service goal. The nationwide power outage, which lasted from 15 minutes to over 3 hours, is an impact to the production/ schedule goal. Damage to the transformer is an impact to the property goal, and the time required for response and repair is an impact to the labor/ time goal.

The second step of problem-solving is the analysis. Using the Cause Mapping method, cause-and-effect relationships are developed. One of the impacted goals is used as the first effect. Asking “Why” questions is one way to determine cause-and-effect relationships. However, there may be more than one cause required to produce an effect. In this example, the power outage resulted from a cascading effect on the country’s generators. This cascading effect was caused by the loss of a hydroelectric facility, which provides 20% of the country’s electricity, and the unreliability of the power grid, due to aging infrastructure. All of these causes were required for this scenario: had the country had a more reliable power grid or more facilities so that the country was not so dependent on one, the loss of the hydroelectric site would not have resulted in nationwide outage.

Continuing the analysis, the loss of the hydroelectric facility was caused by an overload when a key transformer at the site was tripped. According to the power company, the trip was caused by a monkey falling onto the transformer. (There is also photographic evidence showing a monkey in the area of the transformer.) In order for the monkey to fall onto the transformer, it had to be able to access the transformer. The monkey in this case is believed to have fallen off the roof. How this occurred is still unclear, because the facility is secured by an electric fence designed specifically for protection against “marauding wild animals”.

The last step of problem-solving is to determine solutions, based on the analysis of this problem. The utility says it is “looking at ways of further enhancing security” at all their power plants. Unfortunately, total protection against outages caused by animals is impossible. In the United States, animal-caused outages are believed to cause at least $18 billion in lost economy every year. Just this May, raccoons caused outages to 40,000 in Seattle and 5,600 in Colorado Springs. This year also saw outages caused by squirrels, snakes, starlings and geese. Other unusual outages include work on a transformer causing an outage with economic loss of $118 million in Arizona (see our blog on this subject) and a woman with a shovel who cut internet service to nearly all of Armenia (see our blog on this subject).

Because power outages due to animals and other issues can’t be completely eliminated, ensuring a robust power grid is important to minimize the impact from and duration of outages. Calls for improvements to the aging infrastructure in Kenya have resulted from this incident, but these kinds of solutions require not only the cooperation of the utilities, but the country as a whole.

To view the problem outline and Cause Map for this incident, please click on “Download PDF” above

How Did a Cold War Nuclear Bomb Go Missing?

By ThinkReliability Staff

Is there a nuclear bomb lost just a few miles off the coast of Savannah, Georgia? It seems that we will never know, but theories abound. While it is easy to get caught up in the narrative of these theories, it is interesting to look at the facts of what actually happened to piece together the causes leading up to the event. This analysis may not tell us if the bomb is still under the murky Wassaw Sound waters, but it can tell us something about how the event happened.

Around 2 am on February 5, 1958, a training exercise was conducted off the coast of Georgia. This was during the most frigid period of the Cold war, and training was underway to practice attacking specific targets in Russia. During this particular training mission, Major Howard Richardson was flying a B-47 bomber carrying a Mark 15, Mod 0 Hydrogen bomb containing 400 pounds of conventional explosives and some quantity of uranium.

The realistic training mission also included F-86 ‘enemy’ fighter jets. Unfortunately, one of those jets, piloted by Lt. Clarence Stewart, did not see the bomber on his radar and accidentally maneuvered directly into the B-47. The damage to both planes was extensive. The collision destroyed the fighter jet, and severely damaged the fuel tanks, engine, and control mechanisms of the bomber.   Fortunately, Stewart was able to safely eject from the fighter jet. Richardson had a very difficult quest ahead of him: to get himself and his co-pilot safely on the ground without detonating his payload in a heavily damaged aircraft. He flew to the closest airfield; however, the runway was under construction, making the landing even more precarious for the two crew members and for the local community that would have been affected had the bomb exploded upon landing. Faced with an impossible situation, Richardson returned to sea, dropped the bomb over the water, observed that no detonation took place, and returned to carefully land the damaged bomber.

The Navy searched for the bomb for over two months, but bad weather and poor visibility did not make the search easy. On April 16, 1958, the search was ended without finding the bomb. The hypothesis was that the bomb was buried beneath 10 – 15 feet of silt and mud. Since then, other searches by interested locals and the government have still not identified the location of the bomb.   In 2001, the Air Force released an assessment which suggests two interesting points. First, the bomb was never loaded with a ‘detonation capsule’, making the bomb incapable of a nuclear explosion. (Until this time, conventional wisdom suggested that the detonation capsule was included with the bomb.) Second, the report concluded that it would be more dangerous to try to move the bomb than to leave the bomb in its resting place.

While we may never learn the location of the bomb, we can learn from the incident itself. Using a Cause Map, we can document the causes and effects resulting in this incident, providing a visual root cause analysis. Beginning with several ‘why’ questions, we can create a cause-effect chain. In the simplest Cause Map, the safety goal was impacted as a result of the danger to the pilots and to the nearby communities as the result of a potential nuclear bomb explosion. This risk was caused by the bomb being jettisoned from the plane, which was a result of the collision between the fighter jet and the bomber. The planes collided due to the fact that they were performing a training mission to simulate a combat scenario.

More details are uncovered as this event is further broken down to include more information and to document the impact to other goals. The property goal is impacted through the loss of aircraft and the bomb. The bomb is missing because it was jettisoned from the bomber AND because it was never found during the search. The bomb was jettisoned because the pilot was worried that the bomb might break loose during landing. This was due to the fact that the planes collided. The planes collided due to the fact that the F-86 descended onto the top of the B-47 AND because they were in the midst of a training exercise. The fighter jet crashed into the bomber because the bomber was not on radar. The planes were performing an exercise because they were simulating bombing a Russian target, because it was the middle of the Cold War. The search was unsuccessful because the bomb is probably buried deep in the mud AND because the weather and visibility were bad during the search.

Finally, the ‘customer service’ goal is impacted by the fact that the residents in nearby communities are nervous about the potential danger of explosion/radiation exposure. This nervousness is caused by the fact that the bomb is still missing AND the fact that the bomb contained radioactive material, which was due to routine protocol at the time.

Evidence boxes are a helpful way to add information to the Cause Map that was discovered during the investigation. For example, an evidence box stating the evidence from the 2001 Air Force report that the bomb had no detonation capsule has been added to the Cause Map. A Cause Map is a useful tool to help separate the facts from the theories. Click on “Download PDF” above to see the full, detailed Cause Map.

Kansas City Interstate Overpass Closed Due to 20′ Crack

By ThinkReliability Staff

A bridge engineer watching a crack (previously described as “tight”) under the Grand Boulevard bridge noticed it had extended to 20′ on May 6, 2016. He immediately ordered the bridge closed, requiring the rerouting of the more than 9,000 vehicles that use the bridge every day. Replacing the bridge is estimated to cost $5 million.

Luckily, due to the quick action of the engineer, there were no injuries or fatalities as could have occurred due to either the bridge catastrophically collapsing while in use, or for motorists on the Interstate below being struck by large chunks of concrete falling from the overpass.

The overpass failure can be addressed in a Cause Map, or visual root cause analysis. The process begins by capturing the what, when and where of the incident (a bridge failure May 6 in Kansas City) and the impacts to the goals. Because there was the potential for injuries, the safety goal is impacted. The re-routing of over 9,000 vehicles a day is an impact to the customer service goal. The closing of the bridge’s overpass/ sidewalks is an impact to the production goal, and the cost of replacing the bridge is an impact to the property/ labor goal.

By beginning with an impacted goal and asking ‘Why’ questions, cause-and-effect relationships that lay out the causes of an incident can be developed. In this case, the impacted goals are caused by the significant damage to the bridge, due to a rapidly spreading crack.

The failure of any material or object, including all or part of a bridge, results from the stress on that object from all sources overcoming the strength of the object. In this case the stress on the bridge was greater than the strength of the bridge. Stress on the bridge results from each pass of a vehicle over the life of the bridge. In this case, 9,300 vehicles a day transit the bridge, which has been in service since 1963.

Stress also results from large trucks traveling over the bridge. The engineers suspect this is what happened, possibly due to an apartment construction project near the bridge. Says Brian Kidwell, an assistant engineer for the Missouri Department of Transportation, “My hunch is a very heavy load went over it. It could have been a totally legal load.” A “hunch” by an experienced professional is included in the Cause Map as a potential cause. This is indicated with a “?” and requires more evidence.

Legal loads on bridges are based on the allowable stress for a bridge’s strength. However, the strength of the bridge can change over the years. It is likely that happened in this case. Previous damage has been noted on the bridge, which also required bracing last month to fix a sagging section. However, the bridge was deemed “adequate” in an inspection eight months ago. Any needed repairs may not have occurred – there’s never enough money for needed infrastructure improvements. It’s also possible that water entered the empty cylinders that make up the part of the span of the bridge (this is called a “sonovoid” design) and they could have filled with water and later frozen, causing damage that can’t be easily seen externally.

For now, more information will be required to determine what led to the bridge failure. At that point, bridges of similar design may face additional inspections, or be replaced on the long waiting list for repairs. For Kansas City, some are taking a broader – and bolder – view and are recommending the older section of the Interstate “loop” be removed altogether.

To view the Cause Map of the bridge failure, click on “Download PDF” above. Or, click here to learn.

Airplane Emergency Instructions: How do you make a work process clear?

By ThinkReliability Staff

What’s wrong with the process above?

This process provides instructions on how to remove the over-wing exit door on an airplane during an emergency.  However, imagine performing this process in an actual emergency.  During the time you spend opening the door, there will probably be people crowded behind you, frantic to get off the plane.  Step 4 indicates that after the door is detached from the plane wall, you should turn around and set the door (which is about 4’ by 2’ and can weigh more than 50 pounds) on the seats behind you.  In most cases, this will be impossible.  This is why emergency exit doors open towards the outside; in an emergency, a crush against the door will make opening the door IN impossible.

Even if it would be possible to place the door on the seat in the emergency exit row, it would likely reduce the safety of passengers attempting to exit.  As discussed, the exit door is fairly large and heavy.  It is likely to be displaced while passengers are exiting the airplane and may end up falling on a passenger, or blocking the exit path.

However, when this process was tested in training, it probably worked fine.  Why? Because it wasn’t an actual emergency, and there probably weren’t a plane full of passengers that really wanted to get out.  This is just another reason that procedures need to be tested in as close to actual situations as possible.  At the very least, any scenario under which the process is to be performed should be replicated as nearly as possible.

Now take a look at this procedure:

It’s slightly better, not telling us to put the removed door on the seat behind us, but instead it doesn’t tell us what to do with the door. Keep in mind that the person performing this procedure’s “training” likely consisted of a 30-second conversation with a flight attendant and that in all probability, the first time he or she will perform the task is during an emergency situation. When testing a procedure, it’s also helpful to have someone perform the procedure who is not familiar with it, with instructions to do only what the procedure says. In this case, that person would end up removing the door . . . and then potentially attempting to climb out of the exit with the door in their hands. This is also not a safe or efficient method of emergency escape.
This procedure provides a much better description of what should be done with the door. The picture clearly indicates that the door should be thrown out of the plane, where it is far less likely to block the exit or cause passenger injury.

The first two procedures were presumably clear to the person who created them.  But had they been tested by people with a variety of experience levels (particularly important in this case, because people of various experience levels may be required to open the doors in an emergency), the steps that really weren’t so clear may have been brought to light.

Reviewing procedures with a fresh eye (or asking someone to perform the procedure under safe conditions based only upon the written procedure) may help to identify steps that aren’t clear to everyone, even if they were to the writer.  This can improve both the safety, and the effectiveness, of any procedure used in your organization.

The Force Was NOT With Them!

By Jon Bernardi

A long time ago, in a galaxy far, far away, the Empire tried to use their fancy Death Star to keep the member systems in line. This plan did not work out very well, as Death Star One (DS-1) was not able to fulfill its mission of empowering galactic domination! DS-1 had travelled across the galaxy to quell the rebellion at the rebel base on Yavin 4, but did not count on the über-Force of the Rebel Alliance. The Empire did not realize the power of the good side of the Force as the rebels overcame all odds and were able to destroy DS-1. We can do an analysis of the incident to determine the system of causes for the destruction and show those causes visually in a Cause Map.

As much as the Emperor and his minions would not like to see this published, we begin by looking at how the Empire’s goals were impacted. We start by developing an outline of the incident. You might suspect that different factions within the Empire see this problem differently! Some don’t believe there is such a thing as “The Force” and place their faith in the power of the machine. Others use the Dark Side to exploit the mortal weaknesses of the players. The goals of the Empire are impacted in a number of ways: DS-1 is ultimately destroyed, with loss of life, and loss of a dominant-style weapon. The Rebel Alliance has gained a toe-hold against the Empire! We use the impact to the goals as the first effects of our cause-and-effect relationships and will use the disparate view of “the problem” to help us with the branches of the Cause Map.

We already know that DS-1 had planet-busting capabilities, as demonstrated convincingly at Alderaan, Princess Leia’s adopted planet. This may have led the Empire’s power structure to doubt the “Power of the Force” and put their trust in a technological titan, “The ultimate power in the universe!” Even after the plans for the station had been obtained by the Rebellion, the commander of DS-1 still disregarded any concern of vulnerability in his unsinkable marvel. In a remarkable display of hubris, the Empire allows the small band of rebels aboard the Millennium Falcon to escape with the stolen plans for DS-1. The Empire intends to follow them, find the rebel base, and wipe out the rebellion once and for all!

Another branch of the Cause Map follows the path of the stolen plans and the re-awakening of the Force on the planet Tatooine. As we analyze this section of the map, we can see the convergence of causes that led to the technical experts of the Rebel Alliance finally obtaining the plans for DS-1, analyzing them and discovering the dreaded “thermal exhaust port” – (guess even a DS has to have a tailpipe!).

Even a long time ago, we see causes in multiple areas coming together to form the overall picture of the incident. The plucky Rebellion, had THE FORCE with them!

Oil Leaked from shipwreck near Newfoundland

By Kim Smiley

On March 31, 2013, oil was reported in Notre Dame Bay, Newfoundland.  Officials traced the source of the oil back to a ship, the Manolis L, that sank in 1985 after running aground.  The Manolis L is estimated to have contained up to 462 tons of fuel and 60 tons of diesel when it sank and much of that oil is believed to still be contained within the vessel.  Officials are working to ensure the oil remains contained, but residents of nearby communities who rely on tourism and fishing are concerned about the potential for more oil to be released into the environment.

A Cause Map, a visual format for performing root cause analysis, can be built to better understand this issue.  There are three steps in the Cause Mapping process. The first step is to fill out an Outline with the basic background information along with listing how the problem impacts the goals.  There is also space on the Outline to note the frequency of the issue.  For this example, 2013 was the first time oil was reported to be leaking from this particular sunken ship, but there have been 700 at-risk sunken vessels identified in Canadian waters alone.  It’s worth noting this fact because the amount of resources a group is willing to use to address a problem may well depend on how often it is expected to occur.  One leaking sunken ship is a different problem than potentially having hundreds that may require action.

The second step is to perform the analysis by building the Cause Map.  A Cause Map is built by asking “why” questions and laying out the answers to visually show the cause-and-effect relationships.  Once the causes have been identified, the final step is to develop and implement solutions to reduce the risk of similar problems occurring in the future.  Click on “Download PDF” to view an Outline and intermediate level Cause Map for this problem.

In this case, the environmental goal is clearly impacted because oil was released into the environment.  Why? Oil leaked out of a sunken ship because a ship had sunk that contained a large quantity of oil and there were cracks in the hull.  The hull of this particular ship is thin by modern standards (only a half-inch) and it has been sitting in sea water for the last 30 years.  A large storm hit the region right before oil was first reported and it is believed that the hull (already potentially weakened by corrosion) was damaged during the storm.  The Coast Guard identified two large cracks in the ship that were leaking oil during their investigation.

Once the causes of the issue have been identified, the final step is to implement solutions to reduce the risk of future problem.  This is where a lot of investigations get tricky.  It is often easier to identify the problem than to actually solve it. It can be difficult to determine what level of risk is acceptable and how many resources should be allotted to an issue.  The cracks in the hull of the Manolis L have been patched using weighted neoprene sealants and a cofferdam has been installed to catch any oil that leaks out.  The vessel is being monitored by the Canadian Coast Guard via regular site visits and aerial surveillance flights. But the oil remains in the vessel so there is the potential that it could be released into the environment.

Many local residents are fighting for the oil to be removed from the sunken ship, rather than just contained, to further reduce the risk of oil being released into the environment. But removing oil from a sunken ship is very expensive.  In 2013, it cost the Canadian Coast Guard about $50 million to remove oil from a sunken ship off the coast of British Columbia. So far, officials feel that the measures in place are adequate and that the risk doesn’t justify the cost of removing the oil from the vessel. If they are right, the oil will stay safely contained at a fraction of the cost of removing it, but if they are wrong there could be lasting damage to local communities and wildlife.

In situations like this, there are no easy answers.  Anybody who works to reduce risk faces similar tradeoffs and generally the best you can do is to understand a problem as thoroughly as possible to make an informed decision about the best use of resources.

Worker dies while manually measuring tank

By Kim Smiley

The potential danger of confined spaces is well documented, but nine fatalities have shown that people working near open hydrocarbon storage hatches can also be exposed to dangerous levels of hydrocarbon gases and oxygen-deficient atmospheres.  NPR recently highlighted this issue in an article entitled “Mysterious Death Reveals Risk In Federal Oil Field Rules” that discussed the death of Dustin Bergsing.  His job duties included opening the hatch on a crude oil storage tank to measure the level of the oil and was found dead next to an open hatch.  He was healthy and only 21 years old.

A Cause Map, a visual format for performing a root cause analysis, can be used to help explain what happened to cause his death.  A Cause Map intuitively lays out the cause-and-effect relationships that contributed to an issue and is built by asking “why” questions.  Click on “Download PDF” to view a high level Cause Map of this accident.

So why did his death occur?  An autopsy showed that his death occurred because he had hydrocarbons in his blood.  This occurred because he was exposed to hydrocarbon vapor and he remained in the dangerous environment. (When two causes both contribute to an effect, they are listed vertically on the Cause Map and separated by an “and”.)

When a person is exposed to hydrocarbon vapor, they get disoriented before passing out so it is very difficult for them to get to safety on their own.  Bergsing was working alone at the time of his death and no one was aware that he was in trouble before it was too late.

He was exposed to hydrocarbon gases because he opened a hatch on a crude oil storage tank and the gas had collected at the top of the tank.  He opened the hatch because he planned to manually measure the tank level by dropping a rope inside. Manual tank measurement is a common method to determine level in crude oil storage tanks. Crude oil contains volatile hydrocarbons that can bubble out of the crude oil and collect at the top; the gas will rush out of the tank if a hatch is opened.

Additionally, he wasn’t wearing adequate PPE equipment because it wasn’t required by any regulations and there was limited awareness of this danger.

After his and the other deaths, the industry is starting to become more aware of this issue.  The National Institute for Occupational Safety and Health (NIOSH) and the Occupational Safety and Health Administration (OSHA) issued a hazard alert bulletin that identified health and safety risks to workers who manually gauge or sample fluids on production and flowback tanks from exposure to hydrocarbon gases and vapors and exposure to oxygen-deficient atmospheres. In addition to working to raise awareness of the issue, OSHA and NIOSH made recommendations to improve working safety that include the following:

– Implementing alternate procedures that allow workers to monitor tank levels and sample without opening hatches

– Installing hatch pressure indicators

– Conducting worker exposure assessments

– Providing training on the hazard and posting hazard signage

– Not permitting employees to work alone

Please read the OSHA and NIOSH hazard alert bulletin for more information and a full list of the recommendations. Many of the recommendations would be expensive and time-consuming to implement, but some may be relatively simple ways to reduce risk. Continuing to provide information to workers about the potential hazards might be a good first step to improve their safety.