Tag Archives: fatalities

Root Cause Analysis - Incident Investigation

The Dangerous Combination of Hot Cars and Children

By Kim Smiley

Every summer, the news covers heartbreaking stories of children who die after being inadvertently left inside a vehicle.  Since 1998, 527 children have died from heat stroke from being exposed to high temperatures inside a vehicle.  One of the most tragic elements of these stories is that these deaths are preventable.

This issue can be analyzed by building a Cause Map, a visual root cause analysis that intuitively lays out all the causes that contributed to the problem. The first step in building a Cause Map is to determine how the issue affects the overall goals.  In this example, the safety goal is the obvious focus since there have been hundreds of deaths.  The next step is to ask “why” questions and add the answers to the Cause Map.  Why have 527 children died?  They died of heat stroke because they were left inside a car and the interior of the car was hot.  Children also overheat quicker than adults because their thermoregulatory system isn’t as efficient.

The children were left inside the car because they were inadvertently forgotten, a caregiver intentionally left them inside or the children managed to get inside the cars themselves.  There are a number of reasons that a caregiver could forget a small child. The most frightening thing about these incidents is that it can happen to well intentioned, loving parents who simply make a terrible mistake.  These incidents tend to occur most often when there is a change of routine, such as a different parent than normal doing the daycare drop off.  It certainly doesn’t help that many parents and caregivers of young children are tired and potentially sleep deprived. The driver may also not be able to see a small child because many states require backward facing car seats in the back seat.   In the cases where a caregiver intentionally leaves a child and no harm was intended, it’s safe to assume that they didn’t understand the danger.  There are also cases where a child enters a car and becomes trapped inside.  In those examples, the vehicle was most likely unlocked and the caregiver didn’t realize the child was playing in the vehicle.

Vehicles are  especially dangerous because they heat up very quickly to dangerous levels.  A car is an enclosed space with a lot of windows to let in sunlight, making it an ideal situation for temperatures to increase.  Even relatively mild days can result in hot temperatures inside a car.  The temperature inside a car can raise about 40 degrees even when the ambient temperatures are in the 70s, meaning the inside of a car can be over 110 degrees on a fairly cool day.

There are a number of gadgets people have invented to help prevent children from being inadvertently forgotten in a car, but their effectiveness is debated.  The simplest way to prevent this from happening is very low tech; put your purse, shoe or anything that you must have in the backseat.  Another suggestion is to keep a large stuffed animal in the car seat and then move it up to the front passenger seat while the car seat is occupied so that you have a visual reminder of your precious cargo.  The most important thing is to be aware of this deadly problem and have a plan to prevent it if you ever drive around children, especially those strapped into car seats.

Root Cause Analysis - Incident Investigation

SL-1 Explosion-The Only Fatal Reactor Accident in the US

By ThinkReliability Staff

The only fatal reactor accident in the United States occurred on January 3, 1961, when an Army prototype known as SL-1 (for stationary, low power reactor, unit 1) exploded, killing the 3 operators who were present.  We’ll use the SL-1 tragedy as an example of how the Cause Mapping process can be applied to a specific incident.  A thorough root cause analysis built as a Cause Map can capture all of the causes in a simple, intuitive format that fits on one page.

The SL-1 tragedy killed the three operators present, which is an impact to the safety goal.  Another goal is that there be no damage to the vessel. In the case of SL-1, the  vessel sustained extensive damage.

The loss of life and vessel damage were both caused by the reactor exploding.  The reactor exploded because it went prompt critical (an uncontrollable, exponentially increasing fission reaction).  The reactor went prompt critical because withdrawal of the central rod can cause prompt criticality and because the rod was rapidly, manually lifted 26.4″ out of the core.

Withdrawal of the central rod can cause prompt criticality due to a lack of shutdown margin in the core, and inadequate safety criteria.

Because most of the evidence was so effectively destroyed, nobody really knows why the control rod was lifted out of the core.  There are two theories (disregarding the bizarre and improbable murder/suicide theory): 1) the control rod got stuck while being lifted to be attached to the drive mechanism, and, as the operator was exerting greater force on it, suddenly came free, resulting in a lift far greater than intended, or that an rod drop testing/exercising was performed improperly.

The control rod may have become stuck and came free while being attached because it was required to be lifted 4″ out of the core and because control rods had been sticking.  The control rods had been sticking for one or more of the following reasons: 1) reduced clearances due to radiation damage (which can cause structural material to swell), 2) the passage was blocked due to loss of poison strips in the channel, caused by poor design and inadequate testing, or 3) lifting equipment not working properly due to inadequate lifting capacity of the lifting equipment.

It’s also possible that an exercising/testing was potentially improperly performed.  This could have occurred because the operators chose to exercise/test the rods, attempting to ensure that they would perform properly, and because they didn’t realize what would happen. This is because of inadequate training and inadequate work instructions.  The testing was also potentially done improperly due to inadequate work instructions.

On a positive note, the SL-1 incident did initiate some positive changes in the nuclear industry.  Most notably, reactor design has improved and incorporated a “one-rod stuck” criteria which specifies that a reactor can NOT go critical by the removal of any one control rod.  Additionally, procedures and training have gotten more intense and more formal, and planning for emergencies has increased.

Root Cause Analysis - Incident Investigation

Hindenburg Crash – May 6, 1937

By ThinkReliability Staff

On May 6th, 1937, the Hindenburg burst into flames over the Lakehurst, NJ Naval Base, after completing a successful trip across the Atlantic.  35 of the 97 passengers (and one of the ground crew) were killed.  The Hindenburg itself was a total loss, and the popularity of airships never recovered after the accident.

The loss of 36 lives and the loss of the Hindenburg were both caused by the fire aboard. The loss of popularity of airships was caused by both the loss of the Hindenburg, and by the loss of lives.  The next question to ask is “Why did the fire occur?”

For the Hindenburg, this is where things start to get interesting.  There are three separate theories about why the fire started.  There are people who believe very strongly in each.   Luckily for us, the beauty of the Cause Map form of a root cause analysis is that we can use it even if we haven’t determined which theory is correct.

The first theory is that the fire started from sabotage.  Because the Hindenburg was frequently used as a Nazi propaganda tool, some thought it was almost too easy of a target for sabotage from anti-Nazi activists (who included in their number the designer of Hindenburg, Dr. Hugo Eckener.)  There was even a “suspicious” character who survived the crash, a German acrobat living in America.  However, eventually the FBI dismissed the idea of sabotage as a “red herring.”

Another theory is that the fire began when static electricity ignited the flammable cover of the airship.  The major proponent of this theory, Dr. Addison Bain, has run tests on pieces of the Hindenburg cover preserved from the wreck site.  (This was not until 1994.)  He has also found supporting evidence from historic records of the Zeppelin company.

The other theory is that static electricity ignited a flammable hydrogen-oxygen mixture.  This was the original cause attributed to the disaster by the U.S. Department of Commerce’s root cause analysis investigation after the crash.  There are also people who claim that Dr. Bain’s theory is physically impossible, and do not specifically champion a cause, but treat this one as the most likely.

Note that we’re not espousing a theory – we are just recording all of the possibilities.  Once we have done that, the Cause Map allows us to find solutions for any potential causes.  Once we have all the theories mapped out, we can use the Cause mMp as a resource to determine the solutions that are most helpful, or continue our root cause analysis investigation to determine which causes are most likely.

Root Cause Analysis - Incident Investigation

Loss of Firefighting Plane Affects Firefighting Efforts

By ThinkReliability Staff

Wildfires in the Rocky Mountain region have been plaguing the nation for weeks.  The firefighting mission took a severe hit when a C-130 that was dropping flame retardant on the fire crashed on the evening of July 1, 2012, killing four of six crewmembers and injuring the other two.  As a result of the crash, the Air Force grounded other C-130s for two days, increasing the work for firefighters on the ground.

Although the Air Force has not released details of what exactly resulted in the plane crash, we can look at the information we do have available in a visual root cause analysis or Cause Map.  We begin by determining which of the organization’s goals were impacted in the Outline.  First, because of the deaths of the crewmembers, the safety goal was impacted.  The environmental and customer service goals were impacted because of the decreased ability to fight wildfires.  The schedule goal was impacted because other C-130s were grounded for two days.  The property goal was impacted because of the damage to the plane, and the labor goal was impacted due to the increased difficulty for remaining firefighters in fighting the fire.

Once we have determined these impacts to the goals, we can begin asking “Why” questions to draw out the cause-and-effect relationships that led to the impacted goals.  The safety, and other goals, were impacted due to the plane crash.  Again, although the Air Force has not released details of its ongoing investigation, it is believed that  downdraft (caused by the same high winds in the area that are helping to keep the wildfires travel) may have contributed to the crash.  An additional contributor is the fact that the plane was likely traveling at extremely low altitude, which allowed the plane to perform its task to help fight wildfires.  Lastly, it is possible that the heavy demands placed on the plane due to the extent of the fires may have contributed to the incident.  If, during the course of the investigation, it is determined that one of these causes was not related to the plane crash, the causes can be crossed out, but left on the map.  Evidence that shows that this cause did not result in the incident should be placed under the box.  This allows us to keep a complete record of which causes were considered.

Once the causes related to the incident have been placed on the map, solutions to mitigate the risk of this type of incident from happening again can be brainstormed and implemented.

To view the Outline and Cause Map, please click “Download PDF” above

Root Cause Analysis - Incident Investigation

Deadly Kansas City Walkway Collapse

By Kim Smiley

On July 17, 1981, the second and fourth floor suspended walkways collapsed at the newly opened Hyatt Regency of Kansas City, Missouri.  A dance contest had attracted a crowd and the atrium under the walkway was filled with people.  This accident killed 113 people and injured 186.

The hotel was newly constructed and the walkways were well maintained.  So how did this happen?

A root cause analysis of this accident shows that there were a number of causes that contributed to the walkways collapsing.  Investigation into the accident shows that the structural design of the walkway was inadequate.  A weld failed which allowed a support rod to pull through the box beam and the walkways fell.

Additionally, the weld had greater stress than normal on it at the time of the failure because a large crowd had gathered to watch a danced content.  About 20 people were on second floor walkway and about 40 were on the fourth floor walkway at the time of the accident.  The higher loading combined to the walkway collapse.

Identifying the failure mechanism is important during an investigation, but a thorough root cause analysis needs to take the analysis farther to really understand the causes.  The reason that an inadequate design was built needs to be determined.

In this case, it appears that the design was changed without approval of the structural engineer.  This resulted from a communication error between the fabricator and the structural engineer.  The structural engineer sent a sketch of a proposed walkway design to the fabricator, assuming that the fabricator would work the details of the design himself. The fabricator assumed the sketch was a finalized drawing.   The fabricator then picked standard parts to fit the sketch.  This resulted in a significant change from the original design and dramatically decreased the load bearing capacity of the walkways.

The original design called for continuous hanger rods (a non-standard part that would have needed to be manufactured) that passed through the fourth floor walkway beam box to the second floor walkway, resulting in the ceiling connecting supporting the weight of both walkways.  The fabricator changed the design to use two shorter rods (standard parts) which resulted in the fourth floor walkway supporting the weight of the second floor walkway, which it wasn’t designed to handle.

It’s important to investigate beyond the point of inadequate design to learn what failed in the design process to prevent future accidents from occurring.

Root Cause Analysis - Incident Investigation

Deadly Plane Crash in Lagos, Nigeria

by ThinkReliability Staff

A devastating air crash in Lagos, Nigeria killed all on board and at least 10 on the ground.  This was the first major commercial air disaster since 2006.  Safety efforts since that disaster resulted in the US Federal Aviation Administration ( FAA) granting Nigerian    airlines its top air-safety rating.  Now concerns about air safety in Nigeria have resurfaced.  As a result of the crash, according to Harold Demuren, head of Nigerian civil aviation body: “We have suspended the entire Dana fleet.  They will be grounded as long as it takes to carry out the necessary investigations into whether they are airworthy.”

We can examine this incident in a Cause Map, or a visual root cause analysis.  We begin with the goals that were impacted.  In this case, the safety goal was impacted due to the deaths of people on the plane and on the ground.  We begin by asking “Why” questions to put together a very simple cause-and-effect relationship.  In this case, after losing both engines, Dana Air flight 992 crashed into a residential building in a highly populated suburb of Lagos, Nigeria, killing all 153 people on board and at least 10 on the ground.

The investigation of the plane crash is still ongoing.  However, it is known that both engines of the plane lost power, causing the plane to rapidly lose altitude and crash into a highly populated area.  Some of the areas being investigated that may have contributed to the crash are:

1) a bird strike (bird remains were found in one engine),

2) poor maintenance (although the plane was regularly inspected, there were also reports of leaking hydraulics and a history of poor airline safety in Nigeria, which appeared to have been remedied in recent years as indicated by the US FAA’s granting of its top air-safety rating,

3) overworked planes, likely due to financial considerations (the plane that crashed was on its fourth trip of the day), and/or

4) the age of the airplane (at 22 years old, it was technically not permitted to fly in Nigeria, which bans the use of planes over 20 years old).

As more information is revealed during the investigation it can be added to the Cause Map.  As the investigation is concluded, there will likely be more changes to Nigerian requirements and oversight for air safety.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Fire kills 146, Leads to Improved Working Conditions

By ThinkReliability Staff

146 workers were killed when a fire raced through the Triangle Company, which occupied the top three floors of a skyscraper in New York City.  The workers were unable to escape the fire.  We can examine this incident using a Cause Map, a visual form of root cause analysis, which allows us to diagram the cause-and-effect relationships that led to organizational issues – in this case, the death of 146 workers.

On March 25, 1911 at approximately 4:40 p.m., a fire began on the 8th floor of a New York City skyscraper (one of three floors housing the Triangle Waist Company).  Although it’s not clear what sparked the fire (cigarettes and sewing machine engines are likely heat sources), a large amount of accumulated scraps (last picked up in January) provided plenty of fuel.  There were no sprinklers and the interior fire hose was not connected to a water source.  The fire spread quickly and burned for approximately a half an hour before firefighters extinguished it.

During that half-hour, 146 workers, mostly young women, were killed.  Nearly all of these workers were from the 9th floor of the building.  Workers from the 8th and 10th floor were able to escape to the ground or roof using the stairs, but one of the access doors on the 9th floor was locked.  This left only one set of stairs and elevators, which did rescue many but were overcrowded and the elevator machinery eventually failed due to heat.  Many attempted to escape using the fire escape, which was not built for quick escape (in fact, experts determined it would take 3 hours to reach ground from the Triangle Company floors) and eventually collapsed due to the collective weight, killing those on it in the fall.

Many workers jumped from the 9th floor, but the force of the fall was too great for the fire nets, which mainly broke and the jumpers died.

People were horrified at the conditions in the factories that resulted in these deaths.  In the following years, public outcry resulted in many workers’ rights improvements, including many advances in regulations regarding fire protection and working conditions.  However, these types of issues continue in other countries that have not defined such requirements.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more

Root Cause Analysis - Incident Investigation

113 Killed When a Plane Hit a Hill in Guadeloupe

By ThinkReliability Staff

Flying into a small airport surrounded by mountains at night, in a thunderstorm, with virtually no support from ground equipment proved to be too difficult for even an experienced pilot.

All 113 passengers and crew on Air France Flight 117 were killed when the plane crashed into a hill near the airport in Point-à-Pitre, Guadeloupe on June 22, 1962. The crash occurred in the early morning hours, during a severe thunderstorm.   We can examine the causes of this tragedy in a Cause Map, a visual form of root cause analysis that shows the cause-and-effect relationships that led to an incident  such as this one.  The VHF (very high frequency) omnidirectional range (VOR) indicator, which helps aircraft determine position and stay on course, at the airport in Guadeloupe was not functional.  (It’s not clear if the crew of the Air France flight was aware of this, or how long the equipment had been broken.)  The plane in question was a Boeing 707.

The safety goal was impacted because all people onboard the plane – passengers and crew – were killed.  The plane (valued at $5.5 million) was completely destroyed.  The lack of a working VOR, and the incorrect information provided by the  Automatic direction finder (ADF) can be considered impacts to the customer service goal.  Beginning with the impacted safety goal, we can ask “Why” questions to begin mapping cause-and-effect relationships.   The passengers and crew were killed (and the plane destroyed) when the plane crashed into a hill.

The plane crashed into a hill because the airport was surrounded by mountains, and the plane strayed off the let down track, which it should have used for its approach to the airport.  The pilot went off track because he was using a visual approach, probably due to the fact that the VOR was not providing data since it was not working.   The pilot was unable to see the track due to low (10 km) visibility and since it was early morning (~4 a.m.).  In addition, the plane received incorrect position indication from the ADF, which appeared to malfunction as a result of the severe thunderstorm in the area.

This incident resulted in concern from pilots of substandard landing conditions at certain airports.  More care is now taken with take-off and landing during inclement weather, poor visibility, or conditions that result in landing with decreased equipment support.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Deadly Sawmill Explosion

By ThinkReliability Staff

An explosion and subsequent fire at a sawmill in British Columbia has killed two workers and injured two dozen more.  Although the cause of the explosion is not known, there have been five explosions linked to wood dust in British Columbia since 2009.

A dust explosion results from the presence of combustible dust, such as that created by the sawmilling process.  In order for an explosion to occur, the dust must be dispersed into the air but confined by a structure in the presence of oxygen and a spark.  (Learn more about dust explosions.) 

To view all the causes that contributed to this tragic explosion, we can examine the incident in a Cause Map, or visual root cause analysis.  We begin with the impacts to the goals. The employee deaths and injuries are an impact to the safety goal.  This is the primary focus of any issue that results in human death or injury.  In addition, the environmental goal was impacted as the smoke migrated to the nearby town.  The production goal was impacted due to the shutdown of the facility.  The property goal was impacted due to destruction of the sawmill, log processing facility, and sorting facility.  Lastly, the investigation and cleanup will impact labor goals.

Once we have determined the impacts to the goals, we can ask why questions to determine the cause-and-effect relationships that led to the incident.  In this case, the injuries were due to the fire.  The fire may have been caused by a dust explosion (explosion due to natural gas leak has been ruled out).  In order for a dust explosion to occur, five factors are necessary: 1) presence of combustible dust, 2) oxygen, 3) dust is dispersed into the air, 4) dust particles are confined, and 5) the mixture is ignited.

In this case, the ignition source is not known and, due to the damage at the facility, may never be conclusively determined.  Similarly, the cause that resulted in the dust being dispersed may also not be known.  The oxygen must be present for worker safety and the dust is confined because it is held within a closed structure.  The dust is present because it is created during sawmilling operations.  What makes a dust combustible depends on the properties of the dust.  This mill was processing pine beetle wood, or wood that was ravaged by beetles.  This makes the wood drier, which results in a drier, finer, more combustible dust.  Thorough cleaning of any facility that creates potentially combustible dust is a necessity – inadequate cleaning (including dust that may gather on hard-to-access surfaces, such as the ceiling) increases the possibility of an explosion.  The union believes that cleaning has been reduced as a result of the economy.

Local government has begun inspections of saw mills but are asking plants to examine potential dust and ignition sources. Reducing dust and ignition sources are the most effective way to reduce risk of dust explosions.  Other solutions being considered include adding water to the air to increase humidity and increased ventilation, which can reduce the confinement of the dust and increase cleanliness.

To view the Outline and Cause Map, please click “Download PDF” above.

 

Root Cause Analysis - Incident Investigation

Deadly Stage Collapse at State Fair

By Kim Smiley

On August 13, 2011, a stage at the Indiana State fair collapsed, killing seven and injuring dozens more.  The accident occurred just before 9 pm as a crowd waited to watch the popular country band Sugarland perform.

Why did the stage collapse?  What caused this tragic accident to occur?

This incident can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  The first step when beginning a Cause Map is to determine what goals have been impacted.  In this example, the focus will be on the safety goal since there were fatalities and many injuries.  Once the impact is determined, the Cause Map is built by asking “why” questions to determine what causes contributed to the accident.

In this example, people were killed and injured because they were near the stage and the stage collapsed.  They were near the stage because they were waiting for a concert and the area had not been evacuated.  The area had not been evacuated because the decision to evacuate wasn’t made in time.  The decision didn’t happen in a timely manner because it wasn’t clear who had the authority to make the decision because there was not an adequate emergency plan in place.  The bad weather wasn’t a surprise.  The storm was being monitored and the National Weather Service had issued a warning, but the decision to evacuate wasn’t made until too late to prevent the tragedy.

Recently findings by investigators determined that the stage collapsed because it wasn’t up to code.  The structure was required to be able to withstand winds up to 68 mph, but the stage collapsed at winds below this limit.  Investigators determined that the lateral supports were inadequate and the stage wasn’t strong enough to stand up to the wind.  The stage also wasn’t inspected because it was a temporary structure and they are not required to be inspected.

On Tuesday, (April 17, 2012)  Indiana Governor Daniels reported that he has ordered temporary outdoor structures to be inspected by the Indiana Department of Homeland Security to help prevent a similar accident in the future.

To view a high level Cause Map of this incident, click “Download PDF” above.