Tag Archives: industrial

Root Cause Analysis - Incident Investigation

Brazilian Nightclub Fire Kills At Least 238 People

1 Comment

By ThinkReliability Staff

A pyrotechnics display meant for outdoor use turned deadly at a band concert in a nightclub in Brazil on January 27, 2013.  The pyrotechnics – which were set off by the band – lit the soundproofing on the ceiling and it spread – with little help from non-functioning fire extinguishers.  The large crowd had difficulty leaving the club, which had only one exit blocked by bouncers who thought patrons were trying to leave without paying.

This tragic incident can be examined using a Cause Map, or visual root cause analysis, which visually diagrams all the causes and impacts related to the nightclub fire.  We begin with the impacted goals.  The safety goal was impacted due to the at least 238 people who were killed and 100 who were injured.  The severe fire is an impact to the environment.  People were unable to exit, which can be considered an impact to the customer service goal.  The loss of the use of the nightclub is an impact to the production goal, and the damage is an impact to the property goal.  Additionally, members of the band and owners of the nightclub are being held, potentially to be charged with manslaughter.  This can be considered an impact to the employee goal.

We begin developing cause-and-effect relationships by asking “Why” questions.  People were killed because they were in the nightclub, unable to exit and there was a severe fire.  Questions have been raised about why the nightclub was even in operation, as its licenses were expired.  People were unable to exit because there was only one exit – completely insufficient for a facility of this size and no windows in the bathroom.  Bouncers were blocking the only exit because they believed patrons were trying to leave without paying – nobody had told them of the fire.  Difficulty seeing the exits due to smoke and lost power resulting from the fire complicated matters even more.

The fire began when the pyrotechnics (heat) lit the soundproofing on the ceiling (fuel).  The fire was unable to be put out due to difficulties reaching the ceiling and non-functioning fire extinguishers.  Specific solutions are being debated by lawmakers in Brazil, but it is hoped that this tragedy will draw attention to – and improve – some of the conditions that contributed to this tragedy.

To view the Outline and Cause Map, please click “Download PDF” above.  Click here to read about another building fire.

 

Root Cause Analysis - Incident Investigation

Supply of Disposable Diapers Threatened by Explosion at Chemical Plant

By Kim Smiley

On September 29, 2012, an explosion at a chemical plant in Japan killed a fire fighter, injured 35 others and did significantly damage.  Chemicals produced at the plant are used in disposable diapers.  The damaged plant will be inoperable for the foreseeable future, which will likely impact the global supply of disposable diapers, a thought that strikes fear in the hearts of many parents of small children.

This incident can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  The first step in building a Cause Map is to identify which goals were affected.  In this case, the safety goal is obviously impacted since there was a fatality and injuries.  The production goal is also a major consideration since the supply of disposable diapers is threatened because the plant will be unable to produce chemicals for a significant amount of time.  The next step is to ask “why” questions to add additional boxes to the Cause Map.

Starting with the safety goal first, we would ask “why” there was a fatality and injuries.  In this example, people were hurt because there was a fire at a chemical plant.  The fire occurred because a tank exploded and it was near other tanks full of flammable chemicals.  The tank exploded because the temperature inside the tank was increasing and it wasn’t cooled in time.  It isn’t clear yet why the temperature was increasing inside the tank, but investigators are working to find the cause.  Once it is known, it can be added to the Cause Map.

At the time of the explosion, efforts were underway to cool off the tank, but they weren’t effective.  Firefighters were working to spray down the tank with cool water to help lower the temperature, but the temperature rose too quickly.  This is also a cause of the fatality.  A fireman was working to connect spray lines near the tank at the time it exploded and he was sprayed with hot chemicals.  Other injuries occurred at the time of explosion and others were sustained during the effort to fight the fire.  It’s possible that one of the reasons that the workers were unable to cool the tank was that the usual method of cooling the tank, injecting nitrogen to decrease the oxygen and control the chemical reactions occurring, might not have been functioning properly.  This is another area that can be clarified on the Cause Map as more information is known.

Looking at the production goal now, a potential shortage of disposable diapers may occur as a result of this accident because the plant produced a significant amount of a chemical used in manufacturing diapers.  This plant produced 20% of world’s supply of one chemical in particular needed for diapers.  Combine this with the fact that the other plants manufacturing this chemical are already operating at maximum capacity and the supply will likely be less than the demand.

The final step in the process is to use the Cause Map to develop solutions to help prevent similar problems from occurring in the future.  It’s premature to discuss specific solutions in this example since the investigation is still ongoing, but the initial Cause Map can easily be expanded and used when all the information is available.

Root Cause Analysis - Incident Investigation

Spill Kills Hundreds of Thousands of Marine Animals

By ThinkReliability Staff

A recent fish kill is estimated to have killed hundreds of thousands of marine life – fish, mollusks, and even endangered turtles – and the company responsible is facing lawsuits from nearby residents and businesses affected by the spill causing the kill.  A paper mill experienced problems with its wastewater treatment facility (the problems have not been described in the media), resulting in the untreated waste, known as “black liquor”, being dumped in the river.  The waste has been described as being “biological” not chemical in nature; however, the waste reduced the oxygen levels in the river which resulted in the kill.

Although it’s likely that a spill of any duration would have resulted in some marine life deaths, the large number of deaths in this case are related to the length of time of the spill.  It has been reported that the spill went on for four days before action was taken, or the state was notified.  The company involved says that action, and reporting to the state, are based on test results which take several days.

Obviously, something needs to be changed so that the company involved is able to determine that a spill is occurring before four days have passed.  However, whatever actions will be taken are as of yet unclear.  The plant will not be allowed to reopen until it meets certain conditions meant to protect the river.  Presumably one of those conditions will be figuring out a method to more quickly discover, mitigate, and report problems with the wastewater treatment facility.

In the meantime, the state has increased discharge from a nearby reservoir, which is raising the water levels in the river and improving the oxygen levels.  The company is assisting in the cleanup, which has involved removing lots of stinky dead fish from the river.  The cleanup will continue, and the river will be stocked with fish, to attempt to return the area to its conditions prior to the spill.

This incident can be recorded in a Cause Map, or a visual root cause analysis.  Basic information about the incident, as well as the impact to the organization’s goals, are captured in a Problem Outline.  The impacts to the goals (such as the environment goal was impacted due to the large numbers of marine life killed) are used to begin the Cause Map.  Then, by asking “Why” questions, causes can be added to the right.  As with any incident, the level of detail is dependent on the impact to the goals.

To view the Outline and Cause Map, click “Download PDF” above.

Root Cause Analysis - Incident Investigation

The Phillips 66 Explosion: Planning for Emergencies

By ThinkReliability Staff

All business strive to make their processes as efficient as possible and maximize productivity.  Minimizing excess inventory only seems sensible, as does placing process equipment in a logical manner to minimize transit time between machines.  However, when productivity consistently takes precedence over safety, seemingly insignificant decisions can snowball when it matters most.

Using the Phillips 66 explosion of 1989 as an example, it is easy to see how numerous efficiency-related decisions snowballed into a catastrophe.  Examining different branches of the Cause Map highlights areas where those shortcuts played a role.  Some branches focus on how the plant was laid out, how operations were run and how the firefighting system was designed.  Arguably, all of these areas were maximized for production efficiency, but ended up being contributing factors in a terrible explosion and hampered subsequent emergency efforts.

For instance, the Cause Map shows that the high number of fatalities was caused not just by the initial explosion.  The OSHA investigation following the explosion highlighted contributing factors regarding the building layout.  The plant was cited for having process equipment located too closely together, in violation of generally accepted engineering practices.  While this no doubt maximized plant capacity, it made escape from the plant difficult and did not allow adequate time for emergency shutdown procedures to complete.  Additionally high occupancy structures, such as the control room and administrative building were located unnecessarily close to the reactors and storage vessels.  Luckily over 100 personnel were able to escape via alternate routes.  But luck is certainly not a reliable emergency plan; the plant should have been designed with safety in mind too.

Nearby ignition sources also contributed to the speed of the initial explosion, estimated to be within 90 to 120 seconds of the valve opening.  OSHA cited Phillips for not using due diligence in ensuring that potential sources of ignition were kept a safe distance from flammable materials or, alternatively, using testing procedures to ensure it was safe to bring such equipment into work zones.  The original spark source will never be known, but the investigation identified multiple possibilities.  These included a crane, forklift, catalyst activator, welding and cutting-torch equipment, vehicles and ordinary electrical gear.   While undoubtedly such a large cloud of volatile gas would have eventually found a spark, a proactive approach might have provided precious seconds for workers to escape.  All who died in the explosion were within 250 feet of the maintenance site.

Another factor contributing to the extensive plant damage was the inadequate water supply for fire fighting, as detailed in the Cause Map.  When the plant was designed, the water system used in the HDPE process was the same one that was to be used in an emergency.  There is no doubt a single water system was selected to keep costs down.  Other shortcuts include placing regular-service fire system pump components above ground.  Of course, the explosion sheared electrical cords and pipes controlling the system, rending it unusable.  Not only was the design of the fire system flawed, it wasn’t even adequately maintained.  In the backup diesel pump system, only one of three pumps was operational; one was out of fuel and the other simply didn’t work.  Because of these major flaws, emergency crews had to use hoses to pump water from remote sources.  The fire was not brought under control until 10 hours after the initial explosion.  As the Cause Map indicates, there may not have been such extensive damage had the water supply system been adequate.

There is a fine line between running processes at the utmost efficiency and taking short-cuts that can lead to dangerous situations.  Clearly, this was an instance where that line was crossed.

Root Cause Analysis - Incident Investigation

The Phillips 66 Explosion: The Rise of Process Safety Management in the Petrochemical Industry

By ThinkReliability Staff

Many of the industrial safety standards that we take for granted are the direct result of catastrophes of past decades.  Today there are strict regulations on asbestos handling, exposure limits for carcinogens, acceptable noise levels, the required use of personal protective equipment, and a slew of other safety issues.  The organization charged with enforcing those standards is the Occupational Health and Safety Administration – OSHA for short.

OSHA was founded in 1970, in an effort to promote and enforce workplace safety, and their stated mission is to “assure safe and healthful working conditions for working men and women”.  However, there was considerable controversy during its early years as it spottily began enforcing, what was perceived as, cumbersome and expensive regulations.  Notable events in the 1980s, such as the Bhopal and West Virginia Union Carbide industrial accidents, raised OSHA’s awareness that fundamental changes were needed to develop more effective safety management systems.

This awareness led to the rise of what is now known as Process Safety Management (PSM).  This discipline covers how industries safely manage highly hazardous chemicals.  OSHA’s PSM standard lays forth multiple requirements such as employee and contractor training, use of hot work permits, and emergency planning.  Unfortunately PSM was still a work-in-progress during the fall of 1989.

On October 23, 1989, the Phillips 66 Petroleum Chemical Plant near Pasadena, Texas, then producing approximately 1.5 billion of high-density polyethylene (HDPE) plastic each year, suffered a massive series of explosions.  23 died and hundreds were injured in an explosion that measured at least 3.5 on the Richter scale and destroyed much of the plant.  Many of the deficiencies identified at the Phillips 66 plant were in violation of OSHA’s PSM directives; directives which had been announced, but had not yet been formally enacted.

Looking at the Phillips 66 Explosion Cause Map, one can see how a series of procedural errors occurred that fateful day.  Contract workers were busy performing a routine maintenance task of clearing out a blockage in a collection tank for the plastic pellets produced by the reactor.  The collection tank was removed, and work commenced that morning.  However, at some point just after lunch, the valve to the reactor system was opened, releasing an enormous gas cloud which ignited less than two minutes later.

The subsequent OSHA investigation highlighted numerous errors.  First, the air hoses used to activate the valve pneumatically were left near the maintenance site.  When the air hoses were connected backwards, this automatically opened the valve, releasing a huge volatile gas cloud into the atmosphere.  It is unknown why the air hoses were reconnected at all.  Second, a lockout device had been installed by Phillips personnel the previous evening, but was removed at some point prior to the accident.  A lockout device physically prevents someone from opening a valve.  Finally, in accordance with local plant policy but not Phillips policy, no blind flange insert was used as a backup.  The insert would have stopped the flow of gas into the atmosphere if the valve had been opened.  Had any of those three procedures been executed properly, there would not have been an explosion that day.  According to the investigation, contract workers had not been adequately trained in the procedures they were charged with performing.

Additionally, there were significant design flaws in the reactor/collector system.  The valve system used had no mechanical redundancies; the single Demco ball valve was the sole cut-off point between the highly-pressurized reactor system and the atmosphere.  Additionally, there was a significant design flaw with the air hoses, as alluded to earlier.  Not only were the air hoses connected at the wrong time, but there was no physical barrier to prevent them from being connected the wrong way.  This is the same reason North American electrical plugs are mechanically keyed and can only be plugged in one way.  It can be bad news if connected incorrectly!  Connecting the air hoses backward meant the valve went full open, instead of closed.  Both of these design flaws contributed to the gas release, and again, this incident would not have occurred if either flaw was absent.

In hindsight, one can see how multiple problems led to such devastating results.  To easily understand the underlying reasons behind the Phillips 66 Explosion of 1989, a high-level Cause Map provides a quick overview of the event.  Breaking a section of the Cause Map down further can provide significant insight into the multiple reasons the event occurred.  The associated PDF for this case shows how different levels of a Cause Map can provide just the right amount of detail for understanding a complex problem such as this one.

The Phillips 66 explosion was a tragedy that could have been avoided.  The industrial safety standards that OSHA is charged with enforcing aim to prevent future tragedies like this one.  While a gradual safety-oriented transformation has come with some pain and a price tag, few will argue that such standards are unnecessary.  Industrial workers deserve to work in an environment where risk to their health has been reduced to the most practical level.