Tag Archives: fatalities

Root Cause Analysis - Incident Investigation

The Salvage Process of Costa Concordia

By ThinkReliability Staff

On September 16, 2013, the fatally stricken Costa Concordia was lifted upright (known as “parbuckling”) after salvage operations that were the most expensive and involved the largest ship ever. The ship ran aground off the coast of Italy January 13, 2012 (see our previous blog about the causes of the ship running aground) and has been lying on its side for the 20 months since.

The ship grounding had immediate, catastrophic impacts, including the death of 32 people. However, it also had longer term impacts, mainly pollution from the fuel, sewage and other hazardous materials stored aboard the ship. It was determined that the best way to minimize the leakage from the ship would be to return it upright and tow it to port, where it the onboard waste could be emptied and disposed of, then the ship broken up for scrap.

Because a salvage operation of this magnitude (due to the size and location of the ship) had never been attempted, careful planning was necessary. Processes like this salvage operation can be described in a Process Map, which visually diagrams the steps that need to be taken for a process to be completed successfully. A Process Map differs from a Cause Map, which visually diagrams cause-and-effect relationships to show the causes that led to the impacts (such as the deaths and pollution). Whereas a Cause Map reads backwards in time (the impacted goals result from the causes, which generally must precede those impacts), a Process Map reads from left to right along with time. (Step 1 is to the left of, and must be performed before, Step 2.) In both cases, arrows indicate the direction of time.

Like a Cause Map, Process Maps can be built in varying levels of detail. In a complex process, many individual steps will consist of more detailed steps. Both a high level overview of a process, as a well as a more detailed breakdown, can be useful when developing a process. Processes can be used as part of the analysis step of an incident investigation – to show which steps in a process did not go well – or as part of the solutions – to show how a process developed as a solution should be implemented.

In the example of the salvaging of the Costa Concordia, we use the Process Map for the latter. The salvaging process is part of the solutions – how to remove the ship while minimizing further damage and pollution. This task was not easy – uprighting the ship (only the first step in the salvage process) took 19 hours, involved 500 crewmembers from 26 countries and cost nearly $800 million. Other options used for similar situations included blowing up the ship or taking it apart on-site. Because of the hazardous substances onboard – and the belief that two bodies are still trapped under or inside the ship – these options were considered unacceptable.

Instead, a detailed plan was developed to prepare for leakage with oil booms that held sponges and skirts, then installed an underwater platform and 12 turrets to aid in the parbuckling and hold the ship upright. The ship was winched upright using 36 cables and is being held steady on the platform with computer-controlled chains until Spring, when the ship will be floated off the platform and delivered to Sicily to be taken apart.

To view the Process Map in varying levels of detail, please click “Download PDF” above. Or, see the Cause Map about the grounding of the ship in our previous blog.

Root Cause Analysis - Incident Investigation

Thousands Injured Each Year From Falling Televisions

By Kim Smiley

Nearly all parents know about the dangers of watching too much television, but a new study shows that too few are aware of the risk of injury from televisions.  The number of television injuries is more than most would guess with more than 17,000 children visiting emergency rooms for  television related injuries each year.   Falling televisions have also caused hundreds of deaths with 29 killed in just 2011.  The rate of injuries associated with televisions is also increasing at an alarming pace, jumping 126% since 1990.

The majority of victims were young children under five.  The accidents seem to be a potentially deadly combination of their lack of situational awareness and unanchored televisions set on unsafe surfaces.  The study didn’t include why the televisions were in unsafe locations, but one theory is that many older televisions are moved into secondary locations that aren’t as safe as families acquire bigger, fancier televisions.  The older televisions may be on dressers or night stands that were never meant to hold televisions.  Children climb the furniture either attempting to turn on the television or retrieve something off the top and the television tumbles down on top of them.  Dressers with drawers are particularly dangerous because children may figure out how to use the drawers as steps and manage to climb much higher than anticipated.

The rapid rate of technological advances may also play a role since typical families are buying new televisions more frequently than in previous decades and the number of televisions in an average home has increased.  The changing design of televisions is also relevant.  New thinner televisions have significantly smaller bases making them top heavy and more likely to topple over.  Many families are also buying bigger televisions with can amplify the danger if they topple.

Experts have suggested a few potential solutions to this problem.  First and foremost, parents need to be made more aware of the issue, possibly through a public awareness campaign.  A campaign to distribute anchoring devices has been discussed as well as providing them with new televisions at purchase.  Another option may be to add stability requirements to new designs so that televisions are less likely to topple.  It is also recommended that parents never store remote controls or toys on top of a television because they may entice children into climbing to reach them.  Only time will tell which solution if any are implemented, but this study is a first step in raising public awareness about this issue.

To view a Cause Map, or visual root cause analysis, of this issue, click on “Download PDF” above.  A Cause Map visually lays out the causes that contribute to a problem to show the cause-and-effect relationships and can help clarify a situation.  The possible solutions are included on the Cause Map.

Root Cause Analysis - Incident Investigation

The loss of the Steamship General Slocum, June 15, 1904

By ThinkReliability Staff

On June 15, 1904, a church group headed out for an excursion through New York City’s East River on the Steamship General Slocum.  Approximately half an hour after the ship left the pier, it caught fire.  Despite being only hundreds of yards from shore, the Captain continued to go full speed ahead in hopes of beaching at North Brother Island, where a hospital was located.  This served to fan the flames quickly over the entire highly flammable ship, killing many in the inferno.  Most of those who were not killed by the fire drowned, even though the Captain did successfully beach the ship at North Brother Island, due to the depth of the water and lack of safety equipment.

To perform a root cause analysis of the General Slocum tragedy, we can use a Cause Map.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.  First we look at the impact to the goals.  On the General Slocum there were at least 1,021 fatalities of the passengers and crew that were aboard.  (However, only two of the crew were killed.)  Additionally, 180 were injured.  There were other goals that were affected but the loss of life makes any other goals insignificant.  The deaths and injuries are impacts to the safety goals.

Passengers drowned because they were in water over their heads with inadequate help or safety equipment.  Passengers were either in the water because they fell when the deck collapsed, or because they jumped into the water trying to avoid the fire.  The water was too deep to stand because only the bow was in shallow water and the passengers could not reach the bow.  This was due to a poor decision on the Master’s part (namely his decision to beach the ship at a severe angle, with the bow in towards the island, instead of parallel to the island, where passengers would have been able to wade to shore.)  Note that the Master himself (and most of the crew) were on the bow side of the ship and were able to (and did) jump off and wade to shore.  The safety equipment, including life preservers, life boats, and life rafts, was mostly unusable due to inadequate upkeep and inadequate inspections.

Passengers (and two crewmembers) were also killed by fire.  Once the fire was started, it spread rapidly and was not put out.    The fire spread rapidly because the ship was highly flammable.  When this ship was constructed, there was no consideration of flammability.  Additionally, the current of air created by the vessel speeding ahead drove the fire across the ship.  The fact that an experienced Master would have allowed this situation was considered misconduct, negligence and inattention to duty – charges for which the Master was later convicted.   The fire was not put out because of inadequate crew effort and insufficient fire-fighting equipment.  The crew effort was inadequate because of a lack of training.  The fire-fighting equipment was insufficient because of inadequate upkeep and inadequate inspections.  (Possibly you are noticing a theme here?)

Although many people have not heard of the General Slocum tragedy, many of its lessons learned have been implemented to make ship travel safer today.  However, many of the solutions were not implemented widely enough or in time to prevent the Titanic disaster from occurring eight years later.  (Although there were nearly as many people killed on the General Slocum, it is believed that the Titanic disaster is more well known because the passengers on Titanic were wealthy, as opposed to the working class passengers on General Slocum.  It is also surmised that sympathy for the highly German population aboard General Slocum was diminished as World War I began.)

In a macabre ending to a gruesome story, ships began replacing their outdated, decrepit life preservers after the investigation on General Slocum.  It was later found that the company selling these new life preservers had hidden iron bars within the buoyant material, in a dastardly attempt to raise their apparent weight.  Unfortunately there were no adequate laws (then) against selling defective life-saving equipment.

Root Cause Analysis - Incident Investigation

Train Derailment Kills 79 in Spain

By Kim Smiley

On July 24, 2013, a train carrying 247 people violently derailed near Santiago de Compostela Spain.  Over 130 were injured and 79 were killed as a result of the accident.  Many details are still unknown, but investigators have determined that the train was traveling about twice the posted speed over a curved section of track.

The derailment was the worst train accident Spain has suffered in 40 years.  Obviously, an investigation is underway and authorities are eager to identify what caused the accident and are working to prevent anything similar from occurring in the future. One of the ways this accident can be analyzed is by building a Cause Map, a visual format for performing a root cause analysis.  A Cause Map visually lays out the different causes that contributed to an accident in an intuitive format that shows the cause-and-effect relationships.

The Cause Mapping process begins by filling in the basic background information for an issue as well as identifying how the incident impacted the goals.  In this example, the safety goal is clearly impacted because there were fatalities and injuries.  The schedule, labor, and material goals were also impacted because of the time and resources needed to investigate and clean up the accident and the damage to the train.  The negative publicity surrounding the accident can also be considered an impact to the customer service goal because people may be hesitant to ride trains if they have concerns about safety.

So why did the train derail?  The train was going too fast to safely navigate a curved section of track.  The train was going fast because it had previously been running on track designed for high speed trains where high speeds were permitted and it didn’t slow down as it entered a section of track where the posted speed was lower.  Operator action was required to slow down the train and it appears that the operator failed to take action.   Investigators are looking to whether there was a mechanical problem of some kind that prevented the train from reducing speed, but early indication is that the operator simply failed to brake and reduce the speed of the train.

A number of factors seem to have contributed to this deadly error by an experienced train operator who was familiar with this portion of track.  European Rail Traffic Management System (ERTMS) automatically controls braking and is installed on most of the track high speed trains operate on in the region, but not on the track where the accident occurred.  The accident occurred at the first potentially dangerous curve after the transition to  track where operator action is necessary to brake the train.  Based on statements by the driver,  he missed the transition to  the track where manual braking is required and didn’t realize that the train was in danger.  It has also come to light that the train driver was on the phone with the train’s ticket inspector immediately prior to the derailment and this distraction likely played a role in the accident.  The initial investigation findings have led to the train’s driver being provisionally charged with multiple counts of homicide by professional recklessness on 28 July 2013.

Regardless of whether the driver is convicted on the charges, the automatic systems involved should be a focus of the investigation.  The safety system sent a warning to the operator about the high speed prior to the accident, but it failed to prevent the accident.  Investigators need to review the timing of the warning and determine whether it came too late.  Other automatic systems such as the ERTMS also have the ability to stop a train that is operating at unsafe speeds, which raises the question of whether the safety systems used on this portion of track are adequate since the accident happened.  Ideally, a single error by a train driver for any reason won’t result in dozens of deaths.

To view a high level Cause Map of this incident, click on “Download PDF” above.  Click here to view a video of the accident.

Root Cause Analysis - Incident Investigation

Deadly Plane Crash at San Francisco Airport

By Kim Smiley

On July 6, 2013, Asiana Airlines Flight 214 crashed while attempting to land at the San Francisco International Airport. Three people have died as a result of the crash and around 180 others were injured, 13 critically. The cause of the crash is currently under investigation, but there were no obvious mechanical issues and the weather was near perfect.

Even though the investigation is still in its infancy, an initial Cause Map can be built to document what is known now about the accident and it can easily be expanded later as more information becomes available. A Cause Map is a visual format for performing a root cause analysis that intuitively lays out the different causes for an accident. The first step in the Cause Mapping process is to fill in an Outline with the basic background information for an issue. On the bottom half of the Outline there is space to document how the problem impacts the overall goals. This is useful because it helps everyone involved in the process understand the big picture and the issues with the more significant impacts can be prioritized first.

There is also space on the Outline to list anything that was different or unusual at the time the problem occurred. It’s important to note any differences because they are usually worth exploring during an investigation because they may have played a role in the accident. In this specific example, this was the first time the pilots had worked together and the two main pilots were both in unfamiliar roles. The pilot landing the plane had limited experience with Boeing 777s even though he was an experienced pilot and this was his first time landing this type of aircraft at the San Francisco airport. There was another pilot instructing him, but it was his first flight as an instructor.

Once the Outline is completed, the next step is to ask “why” question and add the answers to the Cause Map. In this example, we know that the airplane was coming in too low and too slow to land safely, but it isn’t known why that happened. The NTSB has initiated an investigation and the results will reported when the analysis is complete. Some of the early speculation is that there may have been an equipment failure, mismanagement of automated systems or ineffective communication in the cockpit. The fact that this crew was different than the typical staffing has been a focus of investigators, but it isn’t known what role they may have played in the crash.

Another piece of this puzzle is that one of the passengers who died at the crash scene appears to have been killed when she was run over by a fire engine. She was covered in foam on the ground and the firefighters were unaware of her location. Emergency response procedures will need to be reviewed as part of the investigation into this accident to ensure that first responders can do their jobs in the safest way possible.

To view an initial Cause Map of this issue, click on “Download PDF” above.

 

Root Cause Analysis - Incident Investigation

50 Presumed Dead in Canadian Train Disaster

2 Comments

By ThinkReliability Staff

A tragic accident devastated the Canadian town of Lac-Mégantic, Quebec on July 6, 2013.  Much about the issue is still unknown.  When investigating an incident such as this, it can be helpful to identify what is known and information that still needs to be determined.

What is known: a 73-car train was parked in Nantes, Quebec, uphill from Lac-Mégantic.  Of the cars, 72 contained crude oil.  The train was left unattended and late the evening of July 5, 2013, a fire broke out in the locomotive.  While the fire department of Nantes was putting out the fire, they turned off the train’s main engine.  Less than two hours later, the train rolled down the track and derailed in Lac-Mégantic.  After subsequent explosions and long-burning fires, 24 people have been confirmed dead.  26 more are missing.   Much of the town and the train – and the evidence in it – is destroyed.

What is not known: The cause of the initial fire on the train is not known.  Whether or not the fire department should have explicitly notified the train engineer that the main engine had been shut off is not known.  What happened that allowed the train to roll downhill is unknown.

With this number of unknowns, it is helpful to visually lay out the cause-and-effect relationships that occurred, and what impact they had on those affected.  This can allow us to see the holes in our analysis and identify where more evidence is needed.  Once as much evidence as possible has been obtained, additional detail can be added to the cause-and-effect relationships.  Ensuring that all causes related to the incident are included will provide the largest number of solutions, allowing us to choose the most effective.  We can do all this in a Cause Map, or visual root cause analysis.

The first step in using any problem solving methodology is to determine the impact caused by the incident.  In this case, the deaths (and assumed deaths) are our most significant impact.  Also addressed should be the crude oil leakage (though much of it was likely burned off), the high potential for lawsuits, the possible impact on rail shipments, the destruction of the town and the train, and the response and cleanup efforts.  These form the initial “effects” for our cause-and-effect analysis.

Asking “Why” questions allows us to further develop the cause-and-effect relationships.  We know that for the train to roll backwards down the hill, both sets of brakes had to be ineffective.  The railway company has stated that the air brakes released because the main engine had been shutdown.  However, according to the New York Times, “since the 19th century, railways in North America have used an air-braking system that applies, rather than releases, freight car brakes as a safety measure when it loses pressure.”  This certainly makes more sense than having brakes be dependent on engine power.

The hand brakes functioned as backup brakes.  The number of cars (which, when on a hill, affects the force pulling on the train) determines the number of handbrakes required.  In this case, the engineer claims to have set 11 handbrakes, but the rail company has now stated that they no longer believe this.  No other information – or evidence that could help demonstrate what happened to either sets of brakes – has been released.

Also of concern are the style of train cars – believed to be the same that the NTSB identified in a report on a previous train accident as “subject to damage and catastrophic loss of hazardous materials”.

In a tragedy such as this one, the first priority is to save and preserve human lives in every way possible.  However, once that mission is complete, evidence-gathering to determine what happened is the next priority.  As evidence becomes available it is added directly to the Cause Map, below the cause it supports or refutes.  Additional causes are added as necessary with the goal of determining all the cause-and-effect relationships to provide the largest supply of possible solutions to choose from.

The company involved has already stated it will no longer leave trains unattended.  That should be a big help but, given the consequences of this event, other solutions should be considered as well.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

Root Cause Analysis - Incident Investigation

Chemical Plant Explosion Kills 2 and Injures Dozens in LA

By Kim Smiley

On June 13, 2013, an explosion at a chemical plant in Louisiana killed two and injured more than seventy others.  The cause of the explosion is still unknown, but the federal Occupational Safety and Health Administration and the U.S. Chemical Safety Board are investigating the accident.

Even though the investigation is still ongoing, an initial Cause Map, or visual root cause analysis can be built for this issue.  The initial Cause Map can document what is known at this point and can easily be expanded to incorporate more details as they become available.  The first step in the Cause Mapping process is to fill in an Outline with the basic background information for the accident (such as the location, time and date) as well as document what overall goals were impacted by the incident.

In this case, the safety goal was obviously impacted because of the fatalities and injuries.  The damage to the plant is an impact to the material goal and the time the plant is shut down is an impact to the schedule goal.  Once the Outline is complete, including the impacts to the goal, the Cause Map is built by asking “why” questions.  For example, we would ask “why” people were killed and injured and would add that there was an explosion at the chemical plant to the Cause Map.

What caused the explosion isn’t known, but every explosion requires oxygen, a spark and fuel so these basic facts can be added to the Cause Map.  The plant housed a large amount of flammable material because it manufactures polymer grade propylene which is used to make plastics.  If investigators are able to determine what created the spark that information could be added as well as any other relevant information that comes to light.

The Outline also has space to document anything that is different or unusual at the time of the accident.  Anything unusual about the situation when the accident occurred is often a good starting point in an investigation because it may have played a role in the accident.  In this example, the plant was being expanded at the time of the accident and there were many contract workers on site.  If this is found to have played a role in the accident, this information would be incorporated onto the Cause Map as well as the Outline.

The final step of the Cause Mapping process is to use the Cause Map to develop solutions that can be implemented to help prevent a similar problem from occurring in the future.  Once a final Cause Map is built that incorporates all the findings from the investigation, it will be helpful in understanding any lessons to be learned and discussing potential solutions.

To view a high level Cause Map and an Outline for this accident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Failure of the Teton Dam in 1976

by ThinkReliability Staff

On June 5, 1976, workers were called to the Teton Dam on the Teton River in Idaho to attempt to repair a leak.  Workers in bulldozers narrowly avoided being sucked into the dam with their equipment, and watched helplessly as the dam was breached.  It would kill 14 people and cause nearly hundreds of millions of dollars in property and environmental damage.  To examine what went wrong, we can perform a visual root cause analysis, or Cause Map.

The Cause Mapping process begins by determining the impacts to an organization’s goals.  From the perspective of the government, specifically the Bureau of Reclamation, the safety goal is impacted because of the 14 deaths.  The environmental goal is impacted due to the severe impact the dam failure and subsequent flooding had on the ecosystem of the area.  The customer service goal was impacted due to the evacuation of three towns.  The production goal is impacted due to the abandonment of the dam – at a cost of approximately $50 million.  Additionally, property damage of at least $400 million (some estimates are much higher) is an impact to the property goal.  (There were also substantial claims related to the loss of property and livelihood from impacts to industries, particularly fishing.)

Once we have determined the impacts to the goals, we begin with an impacted goal, such as the safety goal, and ask “Why” questions to determine the cause-and-effect relationships that led to the impacted goals (also known as “problems”.)  In the case of the Teton Dam failure, people were killed due to a massive wave of water released from the dam (which was filled to capacity) when it failed.  The dam failure was also the cause of severe damage to the dam, which was never rebuilt, leading to the impacted production goal.

The failure of the dam was found to be caused by erosion and inadequate strength.  Due to the less than ideal geological conditions of the site (which was picked because there were no “good” sites available), unequal stress distribution and inadequate fill material (which was used from the site) led to reduced strength.  Susceptible materials and seepage from leaks in the embankment, caused by joints that were not resistant to water pressure due to inadequate testing, and inadequate protection from water due to an over-reliance on an ineffective curtain intended to stop flow, led to the erosion.

Many geologists had predicted problems with the dam before it was built.  Specifically, in his book “Normal Accidents”, Charles Perrow states “The Bureau ignored its own data that rocks in the area were full of fissures, and in addition they filled the dam too fast . . . All it takes to bring a dam down is one crack, if that crack wets the soil within the interior portions of the dam, turning it into a quagmire.”

Although tragic, and expensive, the failure of the Teton Dam did lead to many reforms in the Bureau of Reclamation, who is responsible for dam safety.  Detailed geological studies performed in order to determine the causes of the dam failure also provided additional insight to the strength provided by various types of earth, erosion and seepage.

Root Cause Analysis - Incident Investigation

Update: Cause of Death of Schoolchildren from Tornado in Moore, Oklahoma Not Drowning

by ThinkReliability Staff

Although they are sometimes treated as a static object, Cause Maps (and any root cause analysis) can – and should – change based on updated or corrected information.  A frequent question we get asked is “What if I make a mistake on my Cause Map?”  Well, you fix it.  Let me show you how.

First, a little background on my error.  Last week, I thought it would be important and useful to demonstrate what had happened in the aftermath of Moore, Oklahoma, after a category 5 tornado hit much of the town, including an elementary school.  (See the previous blog.)  Because there are certain expectations for public safety at an elementary school, I decided to focus the analysis on the children who died at the elementary school and the causes that led to their deaths, as well as information on the potential and implemented solutions to reduce that risk.

I researched how specifically the children had died – an unfortunate necessity to ensure that the solutions are working towards the correct causes – and discovered a statement from the Lt. Gov. of Oklahoma the morning after the tornado saying that the children who died had drowned in the basement due to a burst water main.

As you can imagine, sometimes information that is relayed in the immediate scene of a disaster is not entirely accurate.  In this case, the information that the children had drowned was incorrect.  Rather, the children who died were in a classroom and died from blunt force trauma and asphyxiation (suffocation) due to being struck or covered by debris from the tornado.

Once we have verified that our initial cause-and-effect relationship is incorrect, we can correct the Cause Map.  Rather than just erasing the “wrong” causes and adding in the new causes, we suggest crossing off the causes that have been disproved with evidence.  (Click on “Download PDF” above to see an example of a corrected Cause Map.)  This way anyone who may have seen an earlier version of the Cause Map, or heard the same initial erroneous information that was used to make it, will have a clear version of what did happen, including the evidence that verifies the correct information.

Obviously the fact that the children died is tragic, so some may wonder what difference it makes exactly how they died.  Generally people who are killed in tornadoes are killed by objects striking them.   This is why tornado survival drills focus on getting to spots where there is the least possible dangerous debris, or the least risk of the debris becoming dangerous flying objects. Windowless rooms are recommended, because glass can be broken and easily turn into shrapnel.  Basements are recommended because the strong winds associated with tornados have less access to underground areas.  Bathrooms are another option because most everything in a bathroom is secured to the walls and/or floors.  In a pinch, people seek protection under heavy pieces of furniture.  (Survivors from the affected school have said that they hid under their desks and held on for dear life.)

Because the basement is a recommended sheltering location, the possibility of drowning from  equipment that may be damaged by a tornado meant that the basement needed to be reconsidered as a sheltering location.  Because the school did not have a designated safe room, during the 16-minute warning teachers got their students to anywhere they could, including, in many cases, under their own bodies for protection.  (Again, based on the extreme damage to the school the death toll, while tragic, demonstrates the remarkably quick and effective action  taken the teachers.  I can’t emphasize this enough.)  Because this protection was very likely causally related to the death toll (in that without the amazing response from the teachers the death toll may have been much higher), I added additional evidence to the cause of injury.

Be aware that changing the causes may impact the recommended solutions.  The solutions discussed in the previous blog are still valid, especially the recommendations for inclusion of storm shelters for schools in the area.  An additional clarification added in the update is that this has been required since 1999 (after this school was built).  All the schools being rebuilt as a result of the tornado damage will have storm shelters, as will schools built in the future.  Individual communities will still be faced with the choice of which buildings will and will not be required to have storm shelters, and any incentives that will be put into place to encourage their construction.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

Root Cause Analysis - Incident Investigation

Children Killed When School Hit by Category 5 Tornado

by ThinkReliability Staff

A category 5 (the most destructive) tornado hit Moore, Oklahoma on May 20th, destroying the town and killing 24.  Of those killed, 7 were elementary school children, who drowned when water mains burst in the basement where they were sheltered.

Examining this tragedy can help provide lessons to reduce the risk of this issue happening again.  We can analyze the tornado impact at the most severely impacted elementary school in a Cause Map, in order to visually diagram the cause-and-effect relationships that led to the tragic deaths.

First, we determine the impacted goals.  In this case, all other goals are overshadowed by the deaths of seven  elementary students, and injuries to dozens.  In addition, the school was completely devastated (demonstrating the unbelievable destructive power of the tornado), resulting in early school closure and intense rescue, recovery and cleanup.

To perform our root cause analysis, we begin with the safety goal and ask “Why” questions.  The deaths in this case are reportedly due to drowning, which occurred when children in the basement (a recommended sheltering location in the case of tornadoes) drowned due to water from bursting water mains.  The specific failure mechanism of the failure is not known (and may never be due to the extreme levels of damage) but is likely related to the direct strike of the tornado, which is common in the area (close to the center of tornado alley).

Students who were injured by crushing and asphyxia were in the hallways and bathrooms of the school.  (These are recommended sheltering locations for buildings that don’t have basements.)   It is remarkable that, despite the complete annihilation of the school, students who were sheltered in hallways and bathrooms all survived, thanks in many cases to teachers protecting them with their own bodies.  A 16-minute warning from the National Weather Service combined with carefully rehearsed crisis plans that were put into action, allowed the best possible protection for students in a school without a safe room or storm shelter.

This storm has reignited the discussion about expectations for safety shelters in public places that are prone to natural disasters.  The devastating loss at the school has also raised the safety issue of ensuring that the locations used for shelter are cleared of other potential hazards, such as water mains and fire risks.  Because of the relatively short warning time (16 minutes in this case, which is above average) before a tornado strikes, emphasis on tornado drills and safety plans should continue.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.