Tag Archives: fire

Root Cause Analysis - Incident Investigation

50 Presumed Dead in Canadian Train Disaster

2 Comments

By ThinkReliability Staff

A tragic accident devastated the Canadian town of Lac-Mégantic, Quebec on July 6, 2013.  Much about the issue is still unknown.  When investigating an incident such as this, it can be helpful to identify what is known and information that still needs to be determined.

What is known: a 73-car train was parked in Nantes, Quebec, uphill from Lac-Mégantic.  Of the cars, 72 contained crude oil.  The train was left unattended and late the evening of July 5, 2013, a fire broke out in the locomotive.  While the fire department of Nantes was putting out the fire, they turned off the train’s main engine.  Less than two hours later, the train rolled down the track and derailed in Lac-Mégantic.  After subsequent explosions and long-burning fires, 24 people have been confirmed dead.  26 more are missing.   Much of the town and the train – and the evidence in it – is destroyed.

What is not known: The cause of the initial fire on the train is not known.  Whether or not the fire department should have explicitly notified the train engineer that the main engine had been shut off is not known.  What happened that allowed the train to roll downhill is unknown.

With this number of unknowns, it is helpful to visually lay out the cause-and-effect relationships that occurred, and what impact they had on those affected.  This can allow us to see the holes in our analysis and identify where more evidence is needed.  Once as much evidence as possible has been obtained, additional detail can be added to the cause-and-effect relationships.  Ensuring that all causes related to the incident are included will provide the largest number of solutions, allowing us to choose the most effective.  We can do all this in a Cause Map, or visual root cause analysis.

The first step in using any problem solving methodology is to determine the impact caused by the incident.  In this case, the deaths (and assumed deaths) are our most significant impact.  Also addressed should be the crude oil leakage (though much of it was likely burned off), the high potential for lawsuits, the possible impact on rail shipments, the destruction of the town and the train, and the response and cleanup efforts.  These form the initial “effects” for our cause-and-effect analysis.

Asking “Why” questions allows us to further develop the cause-and-effect relationships.  We know that for the train to roll backwards down the hill, both sets of brakes had to be ineffective.  The railway company has stated that the air brakes released because the main engine had been shutdown.  However, according to the New York Times, “since the 19th century, railways in North America have used an air-braking system that applies, rather than releases, freight car brakes as a safety measure when it loses pressure.”  This certainly makes more sense than having brakes be dependent on engine power.

The hand brakes functioned as backup brakes.  The number of cars (which, when on a hill, affects the force pulling on the train) determines the number of handbrakes required.  In this case, the engineer claims to have set 11 handbrakes, but the rail company has now stated that they no longer believe this.  No other information – or evidence that could help demonstrate what happened to either sets of brakes – has been released.

Also of concern are the style of train cars – believed to be the same that the NTSB identified in a report on a previous train accident as “subject to damage and catastrophic loss of hazardous materials”.

In a tragedy such as this one, the first priority is to save and preserve human lives in every way possible.  However, once that mission is complete, evidence-gathering to determine what happened is the next priority.  As evidence becomes available it is added directly to the Cause Map, below the cause it supports or refutes.  Additional causes are added as necessary with the goal of determining all the cause-and-effect relationships to provide the largest supply of possible solutions to choose from.

The company involved has already stated it will no longer leave trains unattended.  That should be a big help but, given the consequences of this event, other solutions should be considered as well.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more.

Root Cause Analysis - Incident Investigation

Emergency Plan Could Have Saved Lives in TX Plant Explosion

by ThinkReliability Staff

Investigations are still ongoing to determine details on what caused the April 17, 2013 explosion in West, Texas (the subject of a previous blog).  The death toll has risen to at least 14, including 10 emergency workers.  Around 200 are believed to be injured.  The deaths were caused by the explosion of the site AND the proximity of the victims to the site.  The emergency workers were on-site fighting a fire (which was the ignition source of the explosion), but many of those injured had no real reason to be in such a proximity that they would be injured.   

Warning systems and emergency notifications may have resulted in some of the non-emergency response victims getting out of harm’s way.  However, warning systems and notifications like those required for other industrial sites including oil refineries and chemical plants are not required at fertilizer plants.  The plant owner did not comment on emergency management plans for the site.  Senator Barbara Boxer of California will attempt to determine if those requirements need to be strengthened. 

However, even if a warning system had provided sufficient protection to keep nearby citizens from harm, the property damage would have been extensive.  Many properties – including homes and schools – nearby were severely damaged in the blast.  This has led some to believe that there should be an enforced geographical buffer between these types of industrial facilities and other types of facilities, like homes and schools.  The mayor of West has suggested that the plant be rebuilt away from populated areas. 

More and more concerns are being raised about the safety of the plant itself – and the safeguards that could have prevented this explosion.  Despite the large amount of potentially explosive ammonium nitrate stored at the plant, the plant did not have a sprinkler system or fire barrier (which may have prevented the fire from igniting the fertilizer).   

Industrial plants such as these are regulated by a host of state and federal agencies, including the Environmental Protection Agency (EPA).  The EPA required a worst-case scenario from the West site, which identified a release from an anhydrous ammonia storage tank.  The risk of fire or explosion, and the storage of ammonium nitrate were not identified in the scenario, provided in 2011.  (The facility was fined in 2006 for not filing its risk management plan.) 

A key concern is the amount of fertilizer (270 tons) that was stored at the site – which was not disclosed with local governments or federal agencies.  Ammonium nitrate can be used as an explosive (~2.4 tons were used in the Oklahoma City bombing in 1995).  The high volume of ammonium nitrate was not known or disclosed to local or federal officials.   

Most of the victims in this incident were first responders – who had reported to the fire, not knowing the risk they were taking.  The facility had not disclosed the dangers on site, had not provided adequate protection from fire, and had provided little in the way of an effective emergency response plan.   

Every industrial site should have an up-to-date risk/emergency management plan.  The plan needs to be updated whenever new hazards are brought on-site or identified.  It is crucial that these plans be developed and shared with local response organizations, such as fire-fighters, so that they can be prepared for any potential issues.  These plans should also include community engagement to provide necessary information to people in the area as to what actions should be taken.  Existing incident investigations for industrial incidents can be used as a basis for creating these plans.  But, you don’t need to wait until you have a problem at your facility.  Taking the lessons learned from disasters that have already taken place can save your facility – and your community – a tot of heartbreak.   

Remember: A smart man learns from his mistakes, but a wise man learns from others’ mistakes. 

Root Cause Analysis - Incident Investigation

Hindenburg Crash: The Importance – and Difficulty – of Validating Evidence

By ThinkReliability Staff

Since the Hindenburg explosion in 1937, theories have abounded on what caused the leaking gas and spark that doomed the airship and dozens of passengers.  We discussed some of these theories in our previous blog on the Hindenburg disaster.

In December, 2012, a documentary on the Discovery Channel used new evidence to discuss the most likely cause of the disaster.  Yep, that’s right.  76 years after the original explosion, evidence is still being gathered to help determine what really caused the explosion that killed 36 people.

Sometimes evidence is relatively easy to gather – many pieces of equipment now feed into automatic data collectors, which can provide reams of data about what happened for a specific period of time.  Sometimes, however, evidence is much harder to come by. This is especially the case with fires or explosions which frequently destroy much of the available evidence.

When evidence is hard to come by, it is difficult to determine the exact cause-and-effect relationships that led to an incident.  The best we may be able to do is capture different possibilities in a Cause Map, or visual root cause analysis, and leave the causes that haven’t been validated by evidence as possible causes, indicated by a question mark.

Sometimes, determining the exact cause(s) is important enough to result in painstaking efforts like those performed by a team at the South West Research Institute.  The team created three 1/10-scale models, not a small undertaking when the scale models are over 80 feet in length and is inflated with 200 cubic meters of hydrogen.  They then replicated scenarios described by the various theories by setting fire to, and blowing up, the models.  Additionally, they studied archive footage and eyewitness accounts to increase their understanding of the disaster.

As a result, the team now believes they have determined what happened.  Says Jem Stansfield, an aeronautical engineer and the project lead, “I think the most likely mechanism for providing the spark is electrostatic.”   The spark ignited leaking hydrogen, caused by a broken tensioning wire that punctured a gas cell or a sticking gas valve.

View the updated investigation with the recently released evidence incorporated by clicking “Download PDF” above.

Read our detailed writeup on the Hindenburg investigation.

Or, click here to read more from the blog of the on-air historian and technical advisor to the project (some really cool photos of making and destroying the models are included).

Root Cause Analysis - Incident Investigation

Engine Room Fire Results in Cruise Ship Nightmare

By Kim Smiley

On February 10, 2013, an engine room fire on the Carnival Triumph cruise ship knocked out a significant portion of the ship’s electricity and crippled the propulsion system.  Passenger descriptions of the rest of their “vacation” have included the words hellish and nightmare.

This incident can be reviewed by building a Cause Map, a visual format for preparing a root cause analysis.  A Cause Map intuitively lays out the causes that contributed to an issue to visually show cause-and-effect relationships.  The first step in building a Cause Map is to fill in an Outline which includes the basic background information for an issue as well as the ways that the problem impacts the goals.  In this example, a number of goals are impacted such as the customer service because of the many unhappy passengers and negative media coverage; the schedule goal because the delay of the return of the ship; and the safety goal because of there was a potential for illness.    Once the impacts to the goals are determined, the Cause Map is built by asking “why” questions.

Starting with the safety goal, the first step would be to ask “why” there was a potential for illness.  Illness was a very real possibility because of the unsanitary conditions that existed onboard the ship.  The toilets in the aft portion of the ship couldn’t be flushed because the sewage system was inoperable after the fire.  Full toilets and the rolling motion of the ship made a disgusting and unhealthy combination.  There have been many reports of human waste on floors and even leaking between levels onboard the ship which is probably not anybody’s idea of an ideal vacation setting.  Add in the limited electricity available after the fire and passengers faced filthy cabins without lighting or air conditioning.  Food also became an issue because the limited electricity made preparation of hot meals difficult and the supplies diminishing as the ship remained at sea longer than planned.  The ship’s return was delayed because it had to be towed back to port after the fire wiped out its propulsion.

Investigators are working to determine what caused the fire that started this mess.  They have determined that a leak in a fuel oil return line was part of the problem, but it may be months before the details are known.

What is known is that cruise ship fires aren’t as rare as might be expected.  There were reports of 79 fires onboard cruise ships from 1990 to 2011.   While more information is needed to understand the details of this particular fire, there has been speculation that lack of adequate preventative maintenance may contribute to this issue across the cruise industry.  Keeping a cruise ship in port for a week’s worth of maintenance costs tens of millions of dollars and companies have to try to balance this cost with the risk of an issue during operation.  And the risk is big.  If something goes wrong during operation, like it did in this example,  it can be very expensive.   The total cost of the fire onboard Carnival Triumph is estimated to be $80 billion, including 12 cruises that have already been canceled to allow time for repairs.  In addition the negative press isn’t exactly helping entice potential customers into booking a cruise.  Balancing the cost of maintenance with the risk of not performing it is an issue that many industries face.  No one wants to spend money on unnecessary maintenance, but no company wants to make headlines that have the word nightmare in them either.

To view a high level Cause Map of this issue, click on “Download PDF” above.

Check out our previous blog about  the Costa Allegra , another cruise ship that lost power.

Root Cause Analysis - Incident Investigation

Brazilian Nightclub Fire Kills At Least 238 People

1 Comment

By ThinkReliability Staff

A pyrotechnics display meant for outdoor use turned deadly at a band concert in a nightclub in Brazil on January 27, 2013.  The pyrotechnics – which were set off by the band – lit the soundproofing on the ceiling and it spread – with little help from non-functioning fire extinguishers.  The large crowd had difficulty leaving the club, which had only one exit blocked by bouncers who thought patrons were trying to leave without paying.

This tragic incident can be examined using a Cause Map, or visual root cause analysis, which visually diagrams all the causes and impacts related to the nightclub fire.  We begin with the impacted goals.  The safety goal was impacted due to the at least 238 people who were killed and 100 who were injured.  The severe fire is an impact to the environment.  People were unable to exit, which can be considered an impact to the customer service goal.  The loss of the use of the nightclub is an impact to the production goal, and the damage is an impact to the property goal.  Additionally, members of the band and owners of the nightclub are being held, potentially to be charged with manslaughter.  This can be considered an impact to the employee goal.

We begin developing cause-and-effect relationships by asking “Why” questions.  People were killed because they were in the nightclub, unable to exit and there was a severe fire.  Questions have been raised about why the nightclub was even in operation, as its licenses were expired.  People were unable to exit because there was only one exit – completely insufficient for a facility of this size and no windows in the bathroom.  Bouncers were blocking the only exit because they believed patrons were trying to leave without paying – nobody had told them of the fire.  Difficulty seeing the exits due to smoke and lost power resulting from the fire complicated matters even more.

The fire began when the pyrotechnics (heat) lit the soundproofing on the ceiling (fuel).  The fire was unable to be put out due to difficulties reaching the ceiling and non-functioning fire extinguishers.  Specific solutions are being debated by lawmakers in Brazil, but it is hoped that this tragedy will draw attention to – and improve – some of the conditions that contributed to this tragedy.

To view the Outline and Cause Map, please click “Download PDF” above.  Click here to read about another building fire.

 

Root Cause Analysis - Incident Investigation

The Dreamliner’s Battery Nightmare

By Kim Smiley

On January 16, 2013, the Federal Aviation Administration issued an emergency directive grounding all Boeing 787 Dreamliners operated by United States carriers during the investigation into two recent battery fires.  This emergency grounding is an unusually extreme step, especially given that the Dreamliner is a new plane with only six operated by US carriers at this time.

This issue can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  A Cause Map is built by determining how the issue affects the goals of an organization and then asking “why” questions to find the causes that contributed to the problem.  In this example, the schedule goal is impacted because the Dreamliners have been grounded.  Why?  The Dreamliners were grounded because there is a known fire risk because there were two battery fires onboard these airplanes nine days apart.  The fact that the Dreamliner is the first major airliner to extensively use lithium-ion batteries and that fires in these batteries are particularly dangerous also contribute to the problem.   Lithium-ion batteries were used because they are lighter than other batteries and lighter planes use less fuel.  Fires in lithium-ion batteries are dangerous because they are difficult to extinguish because oxygen is released as they burn, which feeds the fire.

Several other goals are also worth considering like the customer service goal which is impacted by the negative publicity generated by this issue and the safety goal because there is a potential for injuries.   The economic impact of this issue could also be very significant since each Dreamliner costs $200 million and there are 800 planes on order in addition to about 50 that were already in service that may need to be repaired.

The battery fires are still being investigated but the cause isn’t known yet.  It may be an issue with manufacturing or the design itself.  What is known is that the Dreamliner is a brand new design that incorporates many new elements such as mostly electrical flight systems, an airframe that uses composite materials and the use of the lithium-ion batteries themselves.  The design process was also different from previous Boeing designs with much of the work outsourced to a network of global suppliers and very tight deadlines.

As more information becomes available, the Cause Map can easily be expanded to incorporate it.  To view a high level Cause Map of this issue, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

112 Killed in Garment Factory Fire in Bangladesh

By Kim Smiley

At least 112 were killed in a fire at a garment factory in Bangladesh on November 25, 2012. Officials are still investigating what caused the fire, but many disturbing facts about the disaster have already come to light.

This fire can be analyzed by building a Cause Map, a visual root cause analysis.  When constructing a Cause Map, the first step is to fill in an Outline that lays out the basic facts of the incident.  The impacts to the goal are also listed in the Outline and are used as the first box in the Cause Map.  The Cause Map visually lays out the different things that contributed to an issue and shows the cause-and-effect relationship between the different causes.  In this example, the safety goal was the focus because of the number of lives lost.

So many lives were lost because people were working in the garment factory, there was a fire in the factory, workers were unable to quickly leave the factory and the fire burned for a long time.  People were working in a garment factory because this type of factory work is very common in Bangladesh.  Bangladesh is the world’s second largest producer of garments and work in the industry is one of the main sources of stable income available.  About a third of the population of Bangladesh lives in extreme poverty.  Many of the garment workers are also women, who have limited options for employment.   Investigators have not determined what started the fire, but some government officials have speculated that it may have been arson or sabotage.  Workers were unable to get out of the factory quickly because there was only one exit and the stairways were partially blocked by piles of garments.  There were no emergency exits or fire escapes.  The fire burned all night because it was difficult for fire fighters to reach the factory because it wasn’t easily accessible by vehicles.

As sad as this story is, it was nearly a much worst tale.  It was after normal working hours and many workers had already left the factory.  About 1,500 workers were employed at the factory, but only 600 workers remained working overtime.

The factory produced garments for Western companies such as Disney, Sears and Wal-Mart.  It is not clear if companies were aware that their products were being produced in dangerous conditions and there is some confusion with the use of subcontractors, but this fire raises difficult questions. What responsibility do companies have to the workers producing their clothing?  Thousands of garment workers have protested demanding justice for those killed.  This issue is farther complicated by the fact that some workers are grateful for the work and willing to work in substandard conditions because it’s better than the alternatives.

This issue is also reminiscent of a fire that killed 146 garment workers in 1911 in New York City.   The public outrage following the 146 deaths helped lead to many improvements in worker safety in the United States.  Click here to view a previous blog on this incident.

Root Cause Analysis - Incident Investigation

Supply of Disposable Diapers Threatened by Explosion at Chemical Plant

By Kim Smiley

On September 29, 2012, an explosion at a chemical plant in Japan killed a fire fighter, injured 35 others and did significantly damage.  Chemicals produced at the plant are used in disposable diapers.  The damaged plant will be inoperable for the foreseeable future, which will likely impact the global supply of disposable diapers, a thought that strikes fear in the hearts of many parents of small children.

This incident can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  The first step in building a Cause Map is to identify which goals were affected.  In this case, the safety goal is obviously impacted since there was a fatality and injuries.  The production goal is also a major consideration since the supply of disposable diapers is threatened because the plant will be unable to produce chemicals for a significant amount of time.  The next step is to ask “why” questions to add additional boxes to the Cause Map.

Starting with the safety goal first, we would ask “why” there was a fatality and injuries.  In this example, people were hurt because there was a fire at a chemical plant.  The fire occurred because a tank exploded and it was near other tanks full of flammable chemicals.  The tank exploded because the temperature inside the tank was increasing and it wasn’t cooled in time.  It isn’t clear yet why the temperature was increasing inside the tank, but investigators are working to find the cause.  Once it is known, it can be added to the Cause Map.

At the time of the explosion, efforts were underway to cool off the tank, but they weren’t effective.  Firefighters were working to spray down the tank with cool water to help lower the temperature, but the temperature rose too quickly.  This is also a cause of the fatality.  A fireman was working to connect spray lines near the tank at the time it exploded and he was sprayed with hot chemicals.  Other injuries occurred at the time of explosion and others were sustained during the effort to fight the fire.  It’s possible that one of the reasons that the workers were unable to cool the tank was that the usual method of cooling the tank, injecting nitrogen to decrease the oxygen and control the chemical reactions occurring, might not have been functioning properly.  This is another area that can be clarified on the Cause Map as more information is known.

Looking at the production goal now, a potential shortage of disposable diapers may occur as a result of this accident because the plant produced a significant amount of a chemical used in manufacturing diapers.  This plant produced 20% of world’s supply of one chemical in particular needed for diapers.  Combine this with the fact that the other plants manufacturing this chemical are already operating at maximum capacity and the supply will likely be less than the demand.

The final step in the process is to use the Cause Map to develop solutions to help prevent similar problems from occurring in the future.  It’s premature to discuss specific solutions in this example since the investigation is still ongoing, but the initial Cause Map can easily be expanded and used when all the information is available.

Root Cause Analysis - Incident Investigation

Hindenburg Crash – May 6, 1937

By ThinkReliability Staff

On May 6th, 1937, the Hindenburg burst into flames over the Lakehurst, NJ Naval Base, after completing a successful trip across the Atlantic.  35 of the 97 passengers (and one of the ground crew) were killed.  The Hindenburg itself was a total loss, and the popularity of airships never recovered after the accident.

The loss of 36 lives and the loss of the Hindenburg were both caused by the fire aboard. The loss of popularity of airships was caused by both the loss of the Hindenburg, and by the loss of lives.  The next question to ask is “Why did the fire occur?”

For the Hindenburg, this is where things start to get interesting.  There are three separate theories about why the fire started.  There are people who believe very strongly in each.   Luckily for us, the beauty of the Cause Map form of a root cause analysis is that we can use it even if we haven’t determined which theory is correct.

The first theory is that the fire started from sabotage.  Because the Hindenburg was frequently used as a Nazi propaganda tool, some thought it was almost too easy of a target for sabotage from anti-Nazi activists (who included in their number the designer of Hindenburg, Dr. Hugo Eckener.)  There was even a “suspicious” character who survived the crash, a German acrobat living in America.  However, eventually the FBI dismissed the idea of sabotage as a “red herring.”

Another theory is that the fire began when static electricity ignited the flammable cover of the airship.  The major proponent of this theory, Dr. Addison Bain, has run tests on pieces of the Hindenburg cover preserved from the wreck site.  (This was not until 1994.)  He has also found supporting evidence from historic records of the Zeppelin company.

The other theory is that static electricity ignited a flammable hydrogen-oxygen mixture.  This was the original cause attributed to the disaster by the U.S. Department of Commerce’s root cause analysis investigation after the crash.  There are also people who claim that Dr. Bain’s theory is physically impossible, and do not specifically champion a cause, but treat this one as the most likely.

Note that we’re not espousing a theory – we are just recording all of the possibilities.  Once we have done that, the Cause Map allows us to find solutions for any potential causes.  Once we have all the theories mapped out, we can use the Cause mMp as a resource to determine the solutions that are most helpful, or continue our root cause analysis investigation to determine which causes are most likely.

Root Cause Analysis - Incident Investigation

Fire kills 146, Leads to Improved Working Conditions

By ThinkReliability Staff

146 workers were killed when a fire raced through the Triangle Company, which occupied the top three floors of a skyscraper in New York City.  The workers were unable to escape the fire.  We can examine this incident using a Cause Map, a visual form of root cause analysis, which allows us to diagram the cause-and-effect relationships that led to organizational issues – in this case, the death of 146 workers.

On March 25, 1911 at approximately 4:40 p.m., a fire began on the 8th floor of a New York City skyscraper (one of three floors housing the Triangle Waist Company).  Although it’s not clear what sparked the fire (cigarettes and sewing machine engines are likely heat sources), a large amount of accumulated scraps (last picked up in January) provided plenty of fuel.  There were no sprinklers and the interior fire hose was not connected to a water source.  The fire spread quickly and burned for approximately a half an hour before firefighters extinguished it.

During that half-hour, 146 workers, mostly young women, were killed.  Nearly all of these workers were from the 9th floor of the building.  Workers from the 8th and 10th floor were able to escape to the ground or roof using the stairs, but one of the access doors on the 9th floor was locked.  This left only one set of stairs and elevators, which did rescue many but were overcrowded and the elevator machinery eventually failed due to heat.  Many attempted to escape using the fire escape, which was not built for quick escape (in fact, experts determined it would take 3 hours to reach ground from the Triangle Company floors) and eventually collapsed due to the collective weight, killing those on it in the fall.

Many workers jumped from the 9th floor, but the force of the fall was too great for the fire nets, which mainly broke and the jumpers died.

People were horrified at the conditions in the factories that resulted in these deaths.  In the following years, public outcry resulted in many workers’ rights improvements, including many advances in regulations regarding fire protection and working conditions.  However, these types of issues continue in other countries that have not defined such requirements.

To view the Outline and Cause Map, please click “Download PDF” above.  Or click here to read more