Tag Archives: safety

Root Cause Analysis - Incident Investigation

Deadly Tiger Attack

By Kim Smiley

On December 25, 2007, a tiger escaped her enclosure at the San Francisco Zoo and attacked three people.  One 17 year old boy was killed and the other two were injured. The enclosure was built in the 1940s and had safely contained tigers for more than 60 years without incident.

So how did this happen?  How did the tiger escape?

A Cause Map can be built using this example to help determine how this incident was able to occur. To begin a Cause Map, the impacts to the organizational goals are first determined and then “why” questions are asked to add causes to the map.  In this case, there was obviously an impact to the safety goal because one zoo patron was killed and two were injured.  The customer service goal was also impacted because the zoo was closed until January 3, 2008 following the incident.  Why was a zoo patron killed?  He was killed because he was mauled by a tiger.  Why was he mauled?  Because the tiger escaped her enclosure and she went after the victims.

Let’s focus on the question of how the tiger escaped her enclosure first.  An investigation was conducted by the United States Department of Agriculture’s Animal and Plant Health Inspection Service, the government body who is charged with overseeing the nation’s zoos.  Based on claw marks and other evidence at the scene, they determined that the tiger jumped from the bottom of a dry moat and was able to pull herself over the fence surrounding her enclosure.  The investigation also determined the fence was lower than typically used around tiger enclosures.  The Association of Zoos & Aquariums recommends that walls around a tiger exhibit be at least 16.4 feet and the fence around the San Francisco Zoo was only 12.5 feet at the time.

The second question of why the tiger went after the boys is not as easy to answer.  A few experts have stated that the tiger didn’t behave in a typical way.  There has been significant speculation in the media that the victims taunted the tiger or provoked her in some way, but nothing has ever officially been determined.

This focus on the behavior of the victims is a good example of some of the issues that can come up during an investigation.  It can be tempting to focus on assigning blame when investigating an incident.  But the real question is “What should we do to prevent this from happening again?”.  Whether or not the boys provoked the tiger, she should never have been able to escape her enclosure.

After the incident, the zoo extensively remodeled the tiger enclosure, adding a much higher fence and with hotwire at the top to prevent any similar incidents from occurring.

Root Cause Analysis - Incident Investigation

The Phillips 66 Explosion: Planning for Emergencies

By ThinkReliability Staff

All business strive to make their processes as efficient as possible and maximize productivity.  Minimizing excess inventory only seems sensible, as does placing process equipment in a logical manner to minimize transit time between machines.  However, when productivity consistently takes precedence over safety, seemingly insignificant decisions can snowball when it matters most.

Using the Phillips 66 explosion of 1989 as an example, it is easy to see how numerous efficiency-related decisions snowballed into a catastrophe.  Examining different branches of the Cause Map highlights areas where those shortcuts played a role.  Some branches focus on how the plant was laid out, how operations were run and how the firefighting system was designed.  Arguably, all of these areas were maximized for production efficiency, but ended up being contributing factors in a terrible explosion and hampered subsequent emergency efforts.

For instance, the Cause Map shows that the high number of fatalities was caused not just by the initial explosion.  The OSHA investigation following the explosion highlighted contributing factors regarding the building layout.  The plant was cited for having process equipment located too closely together, in violation of generally accepted engineering practices.  While this no doubt maximized plant capacity, it made escape from the plant difficult and did not allow adequate time for emergency shutdown procedures to complete.  Additionally high occupancy structures, such as the control room and administrative building were located unnecessarily close to the reactors and storage vessels.  Luckily over 100 personnel were able to escape via alternate routes.  But luck is certainly not a reliable emergency plan; the plant should have been designed with safety in mind too.

Nearby ignition sources also contributed to the speed of the initial explosion, estimated to be within 90 to 120 seconds of the valve opening.  OSHA cited Phillips for not using due diligence in ensuring that potential sources of ignition were kept a safe distance from flammable materials or, alternatively, using testing procedures to ensure it was safe to bring such equipment into work zones.  The original spark source will never be known, but the investigation identified multiple possibilities.  These included a crane, forklift, catalyst activator, welding and cutting-torch equipment, vehicles and ordinary electrical gear.   While undoubtedly such a large cloud of volatile gas would have eventually found a spark, a proactive approach might have provided precious seconds for workers to escape.  All who died in the explosion were within 250 feet of the maintenance site.

Another factor contributing to the extensive plant damage was the inadequate water supply for fire fighting, as detailed in the Cause Map.  When the plant was designed, the water system used in the HDPE process was the same one that was to be used in an emergency.  There is no doubt a single water system was selected to keep costs down.  Other shortcuts include placing regular-service fire system pump components above ground.  Of course, the explosion sheared electrical cords and pipes controlling the system, rending it unusable.  Not only was the design of the fire system flawed, it wasn’t even adequately maintained.  In the backup diesel pump system, only one of three pumps was operational; one was out of fuel and the other simply didn’t work.  Because of these major flaws, emergency crews had to use hoses to pump water from remote sources.  The fire was not brought under control until 10 hours after the initial explosion.  As the Cause Map indicates, there may not have been such extensive damage had the water supply system been adequate.

There is a fine line between running processes at the utmost efficiency and taking short-cuts that can lead to dangerous situations.  Clearly, this was an instance where that line was crossed.

Root Cause Analysis - Incident Investigation

More Info about Deadly Mine Explosion

By Kim Smiley

Around 3 pm on April 5, 2010 in Montcoal, West Virginia, a huge explosion rocked the Upper Big Branch South mine killing 29 (Click here to read previous blog on the topic).  The toxic gas concentration in the mine remained so high after the accident that Mine Safety and Health Administration investigations were not able to enter the mine for more than two months after the accident.  The final report is still two to three months away, but the MSHA has developed a working theory on what caused the mine explosion.

According to a recent NPR article, investigators believe they have found the source of the spark that started the chain of events that lead to the massive mine explosion.  A longwall mining machine was in operation inside the mine, creating sparks as it ate through both coal and sandstone.  Sparking may have been worse than usual because investigators found that the carbide tipped teeth on the machine were worn down so that bare metal was contacting the stone and coal.

Sparks are expected during these types of operations so a water sprayer system is typically used to prevent explosions from occurring, but investigations found the water system in Upper Big Branch was not functioning properly.  Additionally, a properly functioning water spray system would help control the amount of coal dust in the air.  Coal dust is an accelerant, which means it will contribute to an explosion if ignited.

Another cause of this accident is the level of methane gas in the environment.  The Upper Big Branch South mine is a particularly gassy mine that naturally emitted high levels of methane gas.  There are still some open questions about the role ventilation may have played in the accident.

Small ignitions of methane gas are not uncommon in coal mines, but large explosions are rare.  According to data collected by Mine Safety and Health News, about 600 ignitions have occurred in the past 10 years without any major mine explosions occurring.

Coal mining involves managing a tricky combination of coal dust, methane and sparks.  Usually, no one gets hurt, but in this case the mixture resulted in a massive explosion that traveled more than two miles inside the mine and claimed the lives of 29.  Performing a thorough root cause analysis can help investigators understand what was different in this case and hopefully help the lessons learned be applied to other mines.

As more information comes available, the Cause Map can be expanded to include all relevant details.  Click “Download PDF” above to view the intermediate level Cause Map for this example.

Root Cause Analysis - Incident Investigation

Why Don’t All School Buses Have Seat Belts?

By Kim Smiley

Nearly every state in the US has a law requiring seat belts to be worn in cars. The lone state that doesn’t require adults to wear seat belts, New Hampshire, still has a law requiring children under 18 to wear seat belts.

Currently, only 6 states require seat belt in school buses.  The federal government does not require seat belts to be in installed in buses weighing over 10,000 lbs.  The regular school buses that make up 80 percent of the buses in this country exceed this weight limit and most do not have seat belts.

So if seat belts are required by law in cars, why don’t all school buses have seat belts?

Like most engineering problems, this isn’t as simple a question as it first appears.  The main reason that seat belts aren’t required on all buses is that buses are fundamentally different from cars.

School buses are heavier and taller than cars.  During an accident, a passenger on a bus experiences less severe crash forces than an occupant of a passenger car.  The interior of a modern school bus is designed to protect passengers passively through something called compartmentalization.  The seats are strong, closely-spaced, high backed, and covered in 4 inch thick foam to absorb energy.  The passenger is protected by the cushioned compartment created by the seats.

Buses are considered to be the safest form of ground transportation.  According to the National Highway Traffic Safety Administration, buses are approximately seven times safer than passenger cars or light trucks.

But would seat belts make them even safer?

This is subject to debate.  There are groups pushing for the federal government to require seat belts on all buses.  Others believe that the potential for misuse and incorrectly worn seat belts would actually result in a higher risk to safety if seat belts were installed.  There are also practical considerations like finding funding in cash strapped budgets to install seat belts and to buy the extra buses that would be necessary since fewer students can be accommodated on a bus with seat belts than one without.

There are few topics touchier than the safety of children and no clear cut answers to the question of what constitute a design that is safe enough.  It could be useful when dealing with a problem like this where emotions might run high to document all information in a Cause Map.  A Cause Map is a visual root cause analysis that incorporates the information associated with an issue in an easy to read format.  All pertinent evidence and facts associated with the topic can be recorded.  Having the same facts available to all invested parties can help keep the discussion production and uncover the best solutions.

To learn more about school bus safety, please visit the National Transportation Safety Board website and National Highway Traffic Safety Administration website.