Friday, November 11, 2011

'Human error' blamed for €3.6bn mistake

RTE News Ireland 2 November 2011


Minister for Finance Michael Noonan has said the mistake in the national accounts of €3.6bn was down to "human error". He explained in the Dáil that the double count arose because the Housing Finance Agency had borrowed directly from the NTMA instead of from the open market in 2010.

The miscalculation was described as "a humiliating schoolboy error".

Friday, November 04, 2011

Technical Evaluation, Testing and Validation of the Usability of Electronic Health Records

Pulished in draft from the National Institute of Standard and Technology September 2011

The report summarises the rationale for Usability Protocol for an Electronic Health Record (EHR) that encompasses procedures for (1) expert evaluation of an EHR user interface from a clinical perspective and a human factors best practices perspective, and (2) validation studies of EHR user interfaces with representative user groups on realistic EHR tasks.


Examples of usability issues that have been reported by health care workers are include:
• Some EHR workflows do not match clinical processes create inefficiencies,
• Poorly designed EHR screens slow down the user and sometimes endanger patients,
• Large numbers of files containing historical patient information are difficult to search, navigate, read efficiently, and identify trends over time,
• Warning and error messages are confusing and often conflicting
• Alert fatigue (both visual and audio) from too many messages leading to users ignoring potentially critical messages, and
• Frustration with what is perceived as excessive EHR user interaction (mouse clicks, cursor movements, keystrokes, etc.) during frequent tasks.

A three step process is proposed for the design and evaluation of EHR as follows:

Step One: During the design of an EHR, the development team incorporates the users, work settings and common workflow into the design. Two major goals for this step that should be documented to facilitate Steps Two and Three are: (a) a list of possible medical errors associated with the system usability, and (b) a working model of the design with the usability that pertains to potential safety risks.

Step Two: The Expert Review/Analysis of the EHR step compares the EHR’s user interface design to scientific design principles and standards, identifies possible risks for error and identifies the impact of the design of the EHR on efficiency. This review/analysis can be conducted by a combination of the vendor’s development team and/or by a dedicated team of clinical safety and usability experts. The goals of this step are: (a) to identify possible safety risks and (b) identify areas for improved efficiency.

Step Three: The Testing with Users Step examines the critical tasks identified in the previous steps with actual users. Performance is examined by recording objective data (measured times such as successful task completion, errors, corrected errors, failures to complete, etc.) and subjective data (what users identify). The goals of this step are to: (a) make sure the critical usability issues that may potentially impact safety are no longer present and (b) make sure there are no critical barriers to decrease efficiency. This is accomplished through vendor-evaluator team review meetings where vendor’s system development and evaluation teams examine and agree that the design has (a) decreased the potential for medical errors to desired levels and (b) increased overall use efficiency due to critical usability issues.



Current training programs may not prepare firefighters to combat stress

Medical Xpress 2 November 2011
Article summarises findings from a study by Michael R. Baumann, Carol L. Gohm, and Bryan L. Bonner in an article titled "Phased Training for High-Reliability Occupations: Live-Fire Exercises for Civilian Firefighters,"

The authors assessed the value of current scenario-based training programs and found they may not effectively prepare firefighters for the range of scenarios they are likely to encounter

Firefighters must make complex decisions and predictions and must perform extreme tasks at a moment's notice. Failure to keep a level head in the face of a dangerous situation may result in disastrous consequences. The most common form of training exposes firefighters to one or a very small set of live-fire scenarios designed to reduce stress and encourage calm decision-making skills. But repeated exposure to the same scenario may fail to adequately prepare firefighters for changing situations, as lessons learned in that scenario may not transfer to a different scenario. "If you learn the scenario, you can predict what will happen in that one scenario, but you can't predict what will happen in situations that look a little different," said Baumann. "If you learn general principles, then you can predict what is going to happen in a wide range of situations."

The authors suggest that trainers should increase the range of scenarios to which firefighters are exposed. Desktop-based simulators are available to supplement live-fire training with a variety of scenarios to enable trainees to learn basic principles, even though such simulators cannot replicate a live-fire environment.

Tuesday, November 01, 2011

The Four Phases of Design Thinking

Harvard Business Review blog by Warren Berger 29 July 2011

A good designer has the ability to bring original ideas into the world. They seem to share the same behaviours:

1. Question - Designers ask, and raise, a lot of questions including "stupid questions" that challenge the existing realities and assumptions. Asking "why" can make the questioner seem naïve while putting others on the defensive but it does require people to question and rethink basic fundamentals.

2. Care - Step out of the corporate bubble and actually immerse yourself in the daily lives of people you're trying to serve. Really observing and paying close attention to people. "Focus groups and questionnaires don't cut it."

3. Connect - Taking existing elements or ideas and mashing them together in fresh new ways. You don't necessarily have to invent from scratch but designers know that you must "think laterally" to connect ideas that might not seem to go together.

4. Commit - It's one thing to dream up original ideas. But designers quickly take those ideas beyond the realm of imagination by giving form to them. There is a risk that committing too early increases the possibility of short-term failure but "designers tend to be much more comfortable with this risk than most of us." Innovation is an iterative process and small failures are actually useful because they show the designer what works and what needs fixing.

Friday, October 21, 2011

The Best Approach to Training

Richard Catrambone's Blog from Harvard Business School 20 October 2011

"One of the ironies of being an expert is that you often lose touch with what it is like to be a novice. Part of becoming an expert is that certain aspects of problem-solving just become automatic......

Experts often are unable to articulate the many "obvious" (to them) things they do when carrying out a procedure or solving a problem." "First, the focus must be on identifying what a learner needs to know."

Task analysis is often used to assess problem solving but they often involve the expert to saying what he/she does without necessarily requiring the expert to justify the steps taken.. An approach taken by Catrambone has been to get experts to go through a problem solving exercise, getting them to talk out loud at every step. He asked them to justify every step as they went through.

"One particularly striking result of this process was how often the instructors had to stop and scratch their heads as they tried to provide a justification for their steps." The notes taken have been used to develop improved training material. "The best way to start to train a novice in any field or to develop good instructional materials is for the expert to actually do the tasks in question. There is just no substitute." But a comment on the blog does call into question the approach: "I believe your premise is flawed from a business application perspective. First there is a difference between teaching and training which you seem to use interchangeably.

The deeper issue however is when you state the fundamental premise of your article, what does the individual need to know? This is not the best question to use as the foundation for "the best approach to training." And quite frankly, because too many corporate (and I would venture a guess - too many academics) training efforts start here is why the training they design suck. The starting and end point must be "what does the individual need to do?" "The best approach to training" is to take accountability for designing learning opportunities that change behavior and ultimately impacts results In a positive way."

Thursday, October 20, 2011

Power cut kills Pembroke nursing home man on ventilator

BBC News 19 October 2011

A power cut during the night killed a man with muscular dystrophy as nursing home staff were unable to connect a back-up power supply, an inquest heard. Gavin Proctor, 35, a resident at the Ashdale home in Pembroke, was on a ventilator to help with his breathing. A jury, which returned a narrative verdict, heard he probably would have lived if an emergency generator or a battery pack was connected.

The power failure happened early on 4 January 2009, cutting off the supply to his ventilator and knocking out all the lights. Senior managers at the home told the jury staff were told regularly how to switch on a back-up generator in an emergency. However the inquest heard even if the generator had been switched on, it would not have saved Mr Proctor's life because it did not provide power to his room. Staff would have had to run extension leads to him in the dark, or use back-up battery packs.

The nurse on duty that night, Helen Corcoran, said she had never connected the battery pack before, which Mr Proctor used for going outside, and was not able to see because the torch she found was not working. Mr Proctor suffered a cardiac arrest and died at the scene.

Thursday, September 29, 2011

Peru air crash deaths a 'tragedy of errors' says grieving father

The Guardian 27 September 2011

The crew and four British passengers died when their Cessna plane came down in a field near the Nazca Lines markings in October 2010. An inquest at High Wycombe law courts heard that all six died instantly when the aircraft hit the ground. The verdict was misadventure Fuel could not reach the engine because a cut-off switch had not been checked. .

The pilot had been drinking, the crew argued and preparations were rushed because the booking was made late in the day and the flight had to be completed before a curfew.

Wednesday, September 07, 2011

The Fallacy of People Problems and How to Resolve Them

PharmaPro blog by Jamie Weiss posted 2 September 2011

Statistics in pharmaceutical manufacturing suggest that 80 percent of all reportable deviations are “people problems,” deficiencies of human performance. Despite the pervasiveness of people-caused problems the specific causes attributed are few in number: failure to follow standard operating procedures, skipped or mis-sequenced steps and improper documentation.

But do all of the problems classified as “human factors issues” really indicate a deficiency on the part of a person? Perhaps not. Even classic “people problems,” such as skipping a step in the standard operating procedure (SOP), needs to be examined. This means knowing who the person was, what they did, when it happened etc.. But this requires people to report issues and this can have consequences. Even if they do not fear reprimand, they are likely to be given ownership of the problem and expected to come up with a solution. However, if they keep quiet the chances are production will continue, no one can know and the person does not get landed with the extra work.

When we do look at problems we will sometimes find that people are doing jobs that they are not qualified to do. The test question is: “Could this person do this task if their job or their life, depended on it?” If the answer is yes, then there is no deficiency in the performer. However, for each of us some tasks are simply out of our capabilities and no amount of training would improve our performance.

In this case, retraining is not the option, replacing is. People cannot be expected to do what is impossible for them to learn. Next, consider the response. This asks, “How clear is the desired behaviour that we want from the performer?” “Are we asking for a quantum leap in performance or just a slight tweak?” The response often exposes problems caused by changing the SOP. Perhaps the standards are unclear, the changes too drastic or the expectations unreasonable. If it cannot be changed, training will be required on a constant basis.

The performance system model leaves room for retraining as a corrective action to a people problem, but only when the deficiency is in the performer and even then, only some of the time. Some people are simply not trainable, some skills are not transferable and the optimal solution is rarely “more of the same.” Instead, most corrective actions for performance problems involve addressing the system itself. In short, the solution lies with management to communicate clearly that quality in all its aspects is the priority. This is not done with words and slogans but with rewards, measures ,metrics and behavior. And finally, the solution lies with addressing the common people problem with as much rigor and analytical precision as the most challenging mechanical or biochemical problem.

Wednesday, August 31, 2011

Tests show fastest way to board passenger planes

BBC Website 31 August 2011
The most common way of boarding passenger planes is among the least efficient, tests have shown.

Boarding those in window seats first followed by middle and aisle seats results in a 40% gain in efficiency. However, an approach called the Steffen method, alternating rows in the window-middle-aisle strategy, nearly doubles boarding speed. The approach is named after Jason Steffen, an astrophysicist at Fermi National Laboratory in Illinois, US. Dr Steffen first considered the thorny problem of plane boarding in 2008, when he found himself in a long boarding queue. He carried out a number of computer simulations to determine a better method than the typical "rear of the plane forwards" approach, publishing the results in the Journal of Air Transport Management.

The approach avoids a situation in which passengers are struggling to use the same physical space at the same time.

Only now, though, has the idea been put to the test. Jon Hotchkiss, a television producer making a show called This v That, began to consider the same problem of boarding efficiency and came across Dr Steffen's work. Mr Hotchkiss contacted Dr Steffen, offering to test the idea using a mock-up of a 757 aeroplane in Hollywood and 72 luggage-toting volunteers.

The block approach fared worst, with the strict back-to-front approach not much better. Interestingly, a completely random boarding - as practised by several low-cost airlines that have unallocated seating - fared much better, presumably because it randomly avoids space conflicts.

Birmingham hospital error paralysed Newport teenager

BBC Website 31 August 2011

A teenager was left paralysed from the waist down after a spinal anaesthetic was wrongly left in place for too long, a hospital has admitted.

A pain-killing epidural infusion was not removed for two days after gallstone surgery, permanently damaging her spinal cord. A day after the surgery the patient complained of leg numbness. The following day an MRI scan revealed that the anaesthetic had entered the spinal cord and damaged the membranes, paralysing her from the waist down.

The patient's solicitor called for lessons to be learned. He hoped the staff responsible had already been retrained so that similar "tragedies" could be avoided.

Key Performance Indicators (KPI) for Health and Safety

Taken from RapidBI website, published November 2007

* Cost of solved safety non-conformances for the month
* Employee perception of management commitment
* Health and safety prevention costs within the month
* Lost time (in hours) due to accidents (including fatalities) per e.g. 100,000 hours worked
* Lost time (in hours) due to non-fatal accidents per e.g. 100,000 hours worked
* Number of fatalities per e.g. 100,000 hours worked
* Number of non-conformance with legal or internal standards in safety inspections
* Number of reportable accidents per e.g. 100,000 hours worked (including fatalities)
* Number of reportable non-fatal accidents per e.g. 100,000 hours worked
* Number of safety inspections for the month
* Number of solved safety non-conformances for the month
* Percentage of attendance at occupational health and safety (OHS) committee meetings
* Percentage of corrective actions closed out within specified time-frame
* Percentage of fatal accidents relative to all accidents (non-fatal and fatal) per e.g. 100,000 hours worked
* Percentage of health and safety representatives (HSR) positions filled.
* Percentage of issues raised by H&S Reps actioned
* Percentage of occupational health and safety (OHS) committee recommendations implemented
* Percentage of products/services assessed for health & safety impacts
* Percentage of significant products and services categories subject to procedures in which health and safety impacts of products and services are assessed for improvement
* Percentage of staff with adequate occupational health and safety (OHS) training
* Total of hours in safety and health training in the month

Monday, August 29, 2011

Why should businesses invest in ergonomics?

Central Wisconsin Business 22 August 2011 - the Raikowski column

Statistics from the article:

* The Occupational Health and Safety Administration indicates that MSDs account for one-third of the 1.7 million occupational injuries and illnesses in the U.S. every year and represents its largest work-related injury and illness issue
* Including workers' compensation costs and factors such as restricted duty time, reduced worker productivity, and diminished work product and quality, OSHA estimates that MSDs annually cost the U.S. workforce $54 billion.
* The National Institute for Occupational Safety and Health reviewed hundreds of scientific studies. The estimated cost savings associated with averting a single musculoskeletal disorder-related workers' compensation claim is a whopping $22,546. This total includes the value of lost production, medical costs, insurance administrative costs, and indirect costs to employers.

The FOH cites examples of employers reporting positive returns on their ergonomics program investments including:

* Between 1992 and 1996, the New York Times reported that it reduced its workers' compensation claims by 84 percent, reduced lost work time by 75 percent and decreased lost workdays by 91 percent as a result of its ergonomics program.
* Intracorp reported that a public service company with 330 employees realized a return of $7.35 for every $1 invested in its ergonomics program.
* Northwest Aerospace Company realized a 10- to 15-percent increase in productivity (a benefit of greater than $200,000) following implementation of an ergonomics program.
* Jerome Foods Inc. reported saving $3 for every $1 invested in an ergonomics program.

Thursday, August 18, 2011

Air traffic overhaul hinges on 'human factor'

CNN Website on 10 March 2011 by Thom Patterson


"Even amid the amazing technological achievements and wondrous capabilities of the 21st century, the most critical connection in the airline industry remains the same as it was at the birth of aviation: the human touch."

According to the article the role of the human factors engineer "is to ensure that information is being presented at the right time to a pilot and in the right form so that the human cognitive capabilities are not simply overwhelmed." In particular "What should you put in front of a pilot and in what form should that information be?"

Referring to new air traffic control technology called Automatic Dependent Surveillance-Broadcast (ADS-B) that allows pilots to see a real-time cockpit display that shows the locations of their aircraft and any surrounding aircraft. The challenge is to keep the human in the loop. The plan calls for pilots and air traffic controllers to share more information -- allowing them to better collaborate in avoiding mistakes. They have proven that the human remains in charge and pulls the whole system together, but it requires a rethink in the way information is processed and used.

Another system being developed is a very sophisticated kind of "text message." The aim is to cut confusion caused by misunderstood voice radio transmissions and to improve efficiency by "texting" routine information. Obviously, it is important to make sure this doesn't cause distraction. A lot of messages will be pre-programmed and sent by pilots with the touch of a single button.

Monday, August 15, 2011

$10 piece of equipment could’ve saved $128K in compensation benefits

HR Morning 11 August 2011 by Christian Schappel

The brief article illustrates the potential financial benefits of applying ergonomics. I would add that the employee in question also suffered significant physical harm.

"Angela Grott, a finance clerk at the Menard Correctional Center in Illinois had requested a headset for her phone. The reason: She often had to type while speaking on the phone. Her request was denied, and she carried on with her work — holding her phone receiver in the crook of her neck for hours at a time while typing."

Grott started to suffer from severe neck, shoulder and arm pain and headaches. She underwent surgery in an attempt to relieve her pain. The medical bills came to $128,424 for medical bills and Grott received $7,304 for 12 weeks of temporary disability pay. She may even be able to claim a permanent partial disability claim, which be more than $100,000.

And a headset would have cost about $10.

Friday, August 05, 2011

Smart Keys: Not So Smart for Motorcycles?

Wall Street Journal 30 April 2011 by Jonathan Welsh
"Imagine beginning a ride only to find that you cannot steer.That’s what could happen with certain Ducati motorcycles because of a potential problem with their electronic steering locks, which are part of their anti-theft systems."

The bikes affected are the latest models that come with an electronic ‘smart key” that allows the rider when carrying the key (i.e. in their pocket) to get on the bike, start it and ride away without having to actually handle the key. However, during testing it was found that “under very specific conditions” the electronic steering lock could fail to disengage automatically during the process of turning on the bike’s ignition on and starting the engine. If this happens a rider could potentially start the bike and begin riding while the steering is still locked – an obvious hazard!.

Ducati are recalling the bikes.

Friday, July 29, 2011

CF-18 Hornet crash focuses on human factors

Bonnyville Nouvelle 28 July 2011

Preliminary report into a crash of a CF-18 Hornet crash has found the aircraft was operating normally and focuses on human factors. It was undergoing two-aircraft formation night vision goggles training mission, The pilot ejected and was unharmed.

The report states that as the pilot selected the landing gear, a sudden rush of falling snow, illuminated by his landing light, disoriented him. It reflected through his head up display and washed out the instrument references used to control the aircraft. He thought he was going to crash, could not tell if his avoidance actions were working so ejected.

The pilot was inexperienced at night flying and had not undergone a night vision goggles mission in 224 days. Direction has been given for night vision goggles training to now start “only after a pilot has increased flying experience.”

The investigation continues.

Poland finds Russia at fault for presidential jet crash

BBC Website 28 July 2011

Thursday, July 14, 2011

Human factors in motor racing

Article in the Washington Post on 13 July 2011

An interesting view of human factors vs technology in Formula 1 and Nascar racing.

It suggests the human factor is being taken out of Formula 1 because so much data is streamed back to technicians in the pits. However, Nascar does not allow this in order to "highlight the human element in racing" and "to make the events more interesting to the consumer."

The implication is that technology means human factors are less relevant in Formula 1 than Nascar. I can see what they are getting at, but not sure I agree with their conclusion. I would suggest that human factors in Nascar is limited to one person (the driver) whereas in Formula 1 it is far more of a team effort, which means different and more complex human factors are involved.

Apparently Williams F1 has worked with AT&T to increase the speed at which data gets transmitted, which is now 25 times faster than a standard broadband setup. "The technology has helped cut down on the number of support staff traveling with F1 teams, as well as the cost."

Spelling mistakes 'cost millions' in lost online sales

BBC Website by Sean Coughlan 14 July 2011

Online entrepreneur Charles Duncombe says that poor spelling is costing the UK millions of pounds in lost revenue and that a single spelling mistake can cut online sales in half.

He says he measured the revenue per visitor to the tightsplease.co.uk website and found that the revenue was twice as high after an error was corrected.

"If you project this across the whole of internet retail then millions of pounds worth of business is probably being lost each week due to simple spelling mistakes," says Mr Duncombe, director of the Just Say Please group.

Spelling is important to the credibility of a website, he says. When there are underlying concerns about fraud and safety, then getting the basics right is essential.

When a consumer might be wary of spam or phishing efforts, a misspelt word could be a killer issue”

William Dutton Oxford Internet Institute

"You get about six seconds to capture the attention on a website."

Spelling and grammar are not so important on informal parts of the internet, such as Facebook. However, home pages or commercial offerings that are not among friends and mistakes raise concerns over trust and credibility.

Figures from the Office for National Statistics published last month showed internet sales in the UK running at £527m per week.

Tuesday, July 12, 2011

Ineos fined over Grangemouth refinery oil spill

BBC Website 5 July 2011

The owners of Grangemouth refinery have been fined £100,000 over a spill of highly flammable oil. In the incident, a pipeline became pressurised and sprayed crude oil across a nearby pumphouse and pipelines containing other dangerous liquids.

An investigation found the company had been aware of the risk and the need to install controls.

But it also found Ineos chose to rely on staff to reduce pressure by manually draining oil from the pipeline, and storing it in a skip that was not designed for storing oil.

Further information from SHP magazine 8 July 2011

An incident occurred in May 2007 that resulted in more than 100 litres of crude oil being released on to the floor of a pumphouse. The HSE advised the company to install a hydrostatic release valve, which would divert some of the oil to a storage container once it reached a certain pressure.

However, INEOS failed to act on this suggestion, and it continued to be common practice to allow pressure to build up in the pipes until a warning alarm sounded in the control room when the pressure reached 19 bar. The controller would then instruct a field operative to drain oil from the pipeline to release the pressure.

On 7 May 2008, following a shift change in the control room, staff became confused by the method of work. When the pressure alarm sounded, the controller was unaware that the method of work required him to arrange for the pressure to be released manually. Four hours after the alarm sounded a gasket on the pipeline ruptured and oil began spraying across a nearby pumphouse and adjacent pipelines containing other dangerous substances. Nobody was injured during the leak but it posed a serious risk of causing a fire, or explosion.


According to HSE "Despite having recognised the need for engineered thermal relief on their crude-oil pipelines, following an incident at their refinery a year earlier, INEOS chose instead to rely on a manual system for managing thermal expansion. This system of work actually increased the risk of fire and explosion and ultimately failed to prevent the pipeline from becoming over-pressurised. The risk of over-pressurising pipelines and storage vessels, as a result of thermal expansion, are well-understood, as are the required control measures."

Friday, July 08, 2011

Society has to learn to abhor distracted driving.

NTSB investigation findings 7 July 2011 By Deborah Hersman

The NTSB has determined that a 2010 accident in the Delaware River involving a barge towed by the tugboat Caribbean Sea and killed two Hungarian tourists was caused by the tugboat mate’s failure to maintain a proper lookout due to his repeated use of a cellphone and a laptop computer.

"What’s scary is that no one on board the tugboat objected to the mate’s blatant violation of company policy in making 13 calls and receiving five during the 80 minutes preceding the accident. None of the crew members reported his repeated use of his personal cellphone."

The NTSB has found such use of personal electronic devices to be widespread across all modes of transportation. They included:

* October 2009 - Two airline pilots were out of radio communication with air traffic control for more than an hour because they were distracted by their personal laptops resulting in them overflying their destination by more than 100 miles.
* September 2008 - A commuter train running a red signal in suburban Los Angeles in September 2008 killing 25 and injuring dozens. The engineer, had sent and received 250 text messages during the three days leading up to the accident.
* The driver of a tractor-trailer made 97 calls and received 26 during the 24 hours preceding an accident. And in the half-hour prior to the crash, the driver spent 14 minutes — nearly half his time — on the phone. Ten people died that day after the truck crossed a median.

"Despite company policies, public education campaigns, and, in some places, laws designed to minimize driver distraction, many people continue to engage in unsafe and unacceptable behavior, thinking." "We have to change public tolerance for such distractions and elevate society’s disapproval of the use of personal electronic devices while operating a vehicle."

In 1967, the NTSB investigated the midair collision of a Piedmont Airlines Boeing 727 and a private twin-engine aircraft, which killed all 82 people aboard both planes. The original investigation showed that shortly after takeoff, crew members aboard the 727 discussed a fire in a cockpit ashtray and joked among themselves as they put it out. At the time, cigarette smoking and burning cockpit ashtrays were so common that the NTSB did not even mention the “detail” in the final report.

Today, of course, we can’t imagine smoking in an airplane, much less the cockpit, without anyone’s taking notice. So what has changed since 1967? Cultural and societal expectations. Smoking on airplanes is not only not allowed; it’s not even remotely considered.

Congress first banned smoking on planes in 1988. That law, which applied to flights of two hours or less, took two decades of pressure from health and consumer organizations, as well as repeated warnings about the dangers of secondhand smoke by the National Academy of Sciences and the surgeon general. Today, more than two decades after that initial legislation, society’s disapproval of smoking on airplanes — and in many other public places — is pervasive.

We have to reach the point where texting, phoning, and engaging in other distracting behaviors while operating a vessel, train, or motor vehicle are just as unacceptable as smoking on an airplane. How many more lives will we lose before we correct our tacit and deadly acceptance of distraction?

Tuesday, July 05, 2011

Electoral Commission sorry for out-of-date AMs advice

BBC news 5 July 2011

The elections watchdog has apologised after a new Welsh assembly member fell victim to out-of-date guidance for candidates and was disqualified.

An independent investigation found Liberal Democrat Aled Roberts did everything reasonably expected.

The relevant guidance was changed before the election, but only the English language document was updated. The AM only referred to the Welsh language version, which was out of date.

Monday, July 04, 2011

Why? How? Prove it

Just googling around looking at tips to improve my presentation skills. Came across www.whyhowproveit.co.uk

The suggestion is a four stage approach.

1. Key Message - Leave your audience in absolutely no doubt what you came to tell them in a succinct way

2. Explain to your audience "why should I do that?"

3. Explain how they can do it (this is examples, and actually the least important part of the presentation)

4. Use personal examples, case studies and statistics to prove you are talking sense.

WHPI - seems like a good way of focussing the mind when preparing.

Wednesday, June 29, 2011

Homicide verdict for CEO after health and safety cuts

International Law Office website 27 June 2011

An Italian court has sentenced the chief executive officer (CEO) of a company to 16 years' imprisonment for an offence related to the deaths of seven employees. This is the first such case in Italy in which a CEO has been found guilty of homicide, rather than manslaughter. The court found the company liable under Law 231/2001 and ordered it to pay a fine of €1 million. In addition, it confiscated a further €800,000 and banned the company from receiving public funds for six months.

The case concerned an incident at a factory operated by the company ThyssenKrupp. On the night of December 6 2007 a fire broke out on the production line and could not be extinguished because of a lack of fire extinguishers and the absence of other safety features. Seven workers were killed.

At trial, the prosecutor claimed that ThyssenKrupp's senior management had decided not to invest in health and safety at the factory, since they had decided to relocate production to another site. Therefore, the management knew that it was accepting a risk that a serious accident could occur and was aware of the potential legal consequences of the decision.

The prosecutor argued that if a senior manager decides to reduce investment in health and safety, he or she is aware that there is a high probability of a serious accident. If an accident occurs and someone dies as a result, the manager in question must be deemed guilty of homicide. Although the grounds have not yet been published, the decision indicates that the court appears to have agreed with this argument.

Friday, June 24, 2011

FDA's new guidance tackles device usability, safety

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM259760.pdf

Osprey pilots were blameless victims, widow says

Article at newsobserver.com by Marth Quillin and Bob Cox on 19 June 2011

On 8 April 2000 a newly developed V-22 Osprey crashed during a 'mock exercise,' killing those on board. This is an aircraft with tilting rotors, which can land and take off like a helicopter but fly more like a fixed wing aircraft. Following the crash the Marine Corps investigation concluded that "This mishap appears not to be the result of any design, material or maintenance factor specific to tilt-rotors. Its primary cause, that of a MV-22 entering a Vortex Ring State (Power Settling) and/or blade stall condition, is not peculiar to tilt rotors. The contributing factors to the mishap, a steep approach with a high rate of descent and slow airspeed, poor aircrew coordination and diminished situational awareness, are also not particular to tilt rotors." And in announcing the findings of the report, the Marine Corps said in a press release that it "confirms that a combination of 'human factors' caused the April 8 crash of an MV-22 Osprey tilt-rotor aircraft that killed 19 Marines near Marana, Ariz."

However, the families of those who died feel the language used by the Marine Corps was intended to put most of the blame for the accident on the pilots. They feel that the tragic accident "was the direct result of the crewmen being tasked with an insurmountable, premature mission in a dangerously immature aircraft and not "human factors." They feel the fact that another fatal accident occurred later that year and the aircraft had to be grounded for 18 months for further testing and development back up their opinion.

These were experienced pilots who believed in the Osprey project. In the exercise, pilots were to rescue a group of "hostages" and bring them back to base. The task introduced several variables: night flight, a heavy load of Marines and their gear, and a different environment from the coastal one where the pilots had done most of their training. But as the mission unfolded that night in Arizona, not everything went according to plan. A computer malfunctioned in the lead plane, the pilots decided to continue with the exercise and try to reset the computer after landing. As they approached the landing zone, the planes were too high and were hit with an unexpected tailwind. They began a steep descent aiming for the runway - a piece of cake for an experienced military helicopter pilot. The pilots, doing as they were trained, were following the lead plane, but got out of position and tried to manoeuvre back into line. They had little forward airspeed, and the rotors began to stall, losing the lift that holds the aircraft in vertical flight. Just 200 feet above the ground, in a span of about three seconds, the aircraft rolled uncontrollably to the right and turned upside down before slamming into the ground.

The pilots had gotten into an aerodynamic condition called "vortex ring state" or "blade stall." The lead plane may have had the same problem, but it simply landed very hard, crushing the landing gear and skidding several hundred feet and off the runway.

The family feel there were so many factors in the accident that the pilots should exonerated so that the dishonour can be removed.

I think the comments left on the article make some great points:

* "This aircraft was called the widow maker. This Crash was not an isolated incident."

* "Given the many lessons learned from the tragedy that claimed the lives of the aircrew and the passengers, it seems reasonable to assume that had they not been the ones to experience this mishap, another crew and aircraft would have at another time. Clearly none of the pilots involved in the mishap understood the hazards they faced that evening, or both lead and trail aircraft would certainly have gone around for another pass."

* "If Boeing felt compelled to add warning devices to the cockpit to alert pilots, it sounds that the greatest cause of the crash may well have been the initial design. I hope that the powers that be might eventually reconsider."

Thursday, June 09, 2011

Pilot's bereavement 'crash factor'

Belfast Telegraph 9 June 2011

A helicopter crash involving a police air crew assisting at the scene of an earlier accident may have happened because the pilot was coping with a recent family bereavement, a report has said. The helicopter was destroyed but the occupants suffered only minor injuries.

The pilot, who had completed all the helicopter and role training required by the operator, arrived in Northern Ireland from England two days before the accident, for the start of a five-day period of duty.

"Immediately beforehand, he had suffered a family bereavement. He did not report this to his company and considered on the day that he was fit for flying duty. However, when the pilot subsequently informed the AAIB of the fact, he thought it possible that it may have been a contributory factor in the accident."

The report says that the pilot lost control of the helicopter, which was engaged on a task for the Police Service of Northern Ireland, while manoeuvring at low speed to approach a hilltop landing site in quite strong wind conditions. It descended rapidly before striking the ground short of the point of intended landing and passing through a substantial stone wall.

"The investigation determined that an error of judgment or perception led the pilot to attempt a downwind approach. A combination of human factors was thought to have contributed to the accident," the report said.

The report quoted experts who said the death of a close family member has been found to lead to higher levels of stress than any other experience, with the exception of the death of a spouse or partner, and that such stress will likely to cause loss of concentration and performance. The task to be carried out on the day of the accident, although demanding, was within the capabilities of the pilot.

"However, although the effects on an individual of a recent family bereavement cannot be measured, it is considered that this was probably the most significant contributory factor in the cause of the accident," the report said.

Monday, May 16, 2011

Book priced at $23,698,655.93 on Amazon

A post on Michael Eisen's blog about genomes on 22 April 2011.

An unusual but great example of the potential pitfalls of automation.

Michael wanted to buy a book by Peter Lawrence called The Making of a Fly. He went onto Amazon. Although it was out of print 17 copies were listed for sale: 15 used from $35.54, and 2 new from $1,730,045.91 (+$3.99 shipping).

Michael knew the price of over a million dollars had to be wrong, but he was quite sure it was from legitimate sellers. However, he was even more surprised when the next time he looked the price was nearly $2.8 million. The price peaked on 18 April 2011 at $23,698,655.93 (plus $3.99 shipping).

The explanation is as follows (taken from The Risks Digest)

* Seller A didn't really have the book, but planned to buy it from
Seller B if someone placed an order. They had a better feedback
record than B, so someone might buy it from A even at a higher
price, and had programmed their price to be 27.0589% higher than A's,
so they'd make a profit.

* Seller B, meanwhile, was trying to ensure they just barely had the
lowest price, and had programmed their price to be 0.17% lower than
their competition.

* Both prices were updated automatically once a day—thus rising
exponentially until somebody noticed.

Thursday, May 12, 2011

Make Them Uncomfortable (Avoiding Complacency)

Article from Aviation Week by Heather Baldwin on 11 May 2011

Complacency occurs when people become comfortable in their jobs and begin taking shortcuts, such as not using checklists or using an out-of-date tool rather than making the trek to get a serviceable replacement. It spreads because see someone taking a short cut and think they can get away with it.

Complacency is most likely to occur in job that require repetition. Maintenance technicians are particularly vulnerable because they are often performing similar tasks and end up working in automatic. This narrows their focus and leads to a loss of situational awareness. It is a classic example of where lots of training and experiences leads to problems.

According to Dr. Terry Tolleson of Blue Tuna Training and Documentation "It’s not about skill level; it’s about mental attentiveness." When you’ve done something again and again, "There is a tendency to see what you expect to see." This can lead to very serious errors.

Complacency is one of the harder problems to identify because it is intangible. But there can be warning signs including people not following their own manuals, not completing documentation as it should be and shelf-life sensitive items not being managed in a shop.

Technician workload can have a big influence. Mental underloading and mental overloading can both lead to complacency. Keeping people mentally stimulated but not overloaded is important. Also, creating professional development plans that continually challenge people with new responsibilities and new skill development opportunities. In other words, getting people out of their comfort zone.

Talking about complacency can help.

Friday, April 29, 2011

Behavioural safety - a briefing for workplace representatives

Published by the TUC May 2010 and available here

This is a short document aimed at union representatives. It appears to me to give a pretty balanced warning that behavioural safety programs are not always implemented well, and can result in inappropriate interventions that aim to change worker behaviours' without addressing systems failures.

Human factors to blame for fatal crash of Air India Express flight from Dubai

Article from Arabian Aerospace published 26 April

An inquiry into the The Air India Express IX812 accident at Mangalore airport on May 22 2010 has identified a number of human factors causes. Only eight of the 166 people on board survived.

The Flight-data recorder shows the aircraft crossed the runway threshold at 200ft rather than at the prescribed 50 feet and much faster. As a result it didn’t touch down until 1600 metres along the runway leaving just 860 metres, which meant it overran the runway. The aircraft's right wing collided with an antenna and the aircraft dropped off the edge of a steep gorge.

Investigators say that cockpit voice recordings recorded typical breathing patterns of deep sleep from the Captain, lasting for 1h 28min, until just 21min before the accident. These recording indicated that the captain slept for at least 1h 40min.

During preparations for landing the co-pilot suggested three times that they should "go-around," which was ignored by the captain, and then erroneously confirmed the aircraft was on the correct approach following pressure by the captain to do so.

A contributing factor was that the airport radar was not working and so the landing was conducted on instruments only.

Report suggest that the captain and co-pilot had fallen out several weeks before the accident. This may be why co-pilot did not wake the captain earlier in the flight and contributed to poor communication between the pair. Also, that "prolonged sleep by the captain, particularly during the overnight circadian low period, could have led to sleep inertia and possibly impaired judgement over the approach shortly after he woke."

Saturday, April 23, 2011

Why Air Traffic Controllers Fall Asleep on the Job

There have been a number of stories in the news recently about US air traffic controllers falling asleep on the job. There has been one example of an obvious violation of rules, but overall I wonder about the systemic failures that have caused the problems.

An article in The Wall Street Journal by Langhorne Bond and Robert W Poole Jr discuss the causes.

Apparently the Federal Aviation Authority (FAA) has known about Controller fatigue for decades but "has repeatedly swept it under the rug." One of the likely problems is the shift pattern. One of the most popular is called 2-2-1: Controllers work two swing shifts, two day shifts, and one midnight shift. The second day shifts ends at 2 p.m. and the subsequent midnight shift begins at 10 p.m., just eight hours later. Such a schedule disrupts circadian rhythms, creating fatigue on the midnight shift. Controllers and their union have fought to keep 2-2-1 because it gives them a three-day weekend afterwards.

The National Transportation Safety Board (NTSB) has called for abolishing 2-2-1 and the inspector general for the Department of Transportation has called for a 10-hour minimum between shifts in general, and 16 hours after a midnight shift.

The other cause of fatigue on midnight shifts is black backgrounds on controller display screens, which require dark rooms for best visibility. But dark rooms tend to induce drowsiness, especially on a midnight shift. It is now common international practice to have light gray background screen displays that can be used in high-light environments, but in the U.S. this has been ignored.

Thursday, April 14, 2011

EI launches poster pack to encourage continuous workforce involvement in safety

Available from the Institute website

Good practice in safety across all sectors of the energy industry is of paramount importance. It is generally accepted that engagement with the workforce can lead to safer workplaces as staff become more aware of and involved in mitigating health and safety issues.

With good workforce involvement (WFI), staff, including contractors, are encouraged to take part in the decision making process about managing health and safety in the workplace, however, achieving good WFI requires planned and sustained effort. To support safety managers and leaders in their efforts to implement effective WFI programmes, the Energy Institute (EI) has developed a series of posters to encourage colleagues to contribute to safety in the workplace.

This new poster pack can be used as part of a wider WFI campaign and these resources are supported by Guidance on running a WFI campaign and using the WFI poster pack to help in proactive health and safety management. The posters tackle a number of themes, such as: What stops you from communicating safety issues? What if you are the only person in your team who sees the risk? and What ideas do you have to improve safety? The posters are designed to challenge general perceptions and provoke discussion amongst workers. To support the sharing of ideas, the series also includes space to capture comments to contribute to WFI schemes.

Wednesday, April 13, 2011

Introduction to Higher Reliability Organizations

Article from Fire Engineering website by Dane Carley and Craig Nelson published 11 March 2011.

The number of fatalities experienced by US fire service has not changed much in the last 20 years. "We have good, inspiring leaders who recognize the problem and provide solutions. We have good firefighters and company officers who know their jobs inside and out. They follow the rules, use solid safety practices, and train more often than ever before. Leaders, firefighters, and company officers alike are well trained, well educated, and experienced. Therefore, we believe the problem lies within the number of rules, current safety practices, and our approach to safety."

"Other industries operating in a similar environment where there are severe consequences for a single mistake do not see similar accident statistics."

The article discusses the application of the principles of Higher Reliability Organisations (HRO).

The definition of a HRO is "an organization operating in a complex, high-risk environment in which a single error has the potential for disastrous consequences, yet the organization routinely performs with a low number of errors due to various organizational characteristics intentionally engineered to prevent human error."

"An HRO accomplishes this by consciously implementing a comprehensive plan that hinges on developing a learning culture within an organization using methods such as near-miss reporting and root-cause analysis."

"An HRO recognizes that organizations are comprised of humans who, no matter how diligent they are, make mistakes. In organizations like the fire service, we must first accept that we all make mistakes, no matter how smart, educated, or talented we are. An HRO builds systems on five basic principles to prevent a mistake, compensate when a mistake does occur, and then learn from the mistake to prevent it from occurring again. Weick and Sutcliffe (2007) list the principles of an HRO as:

Preoccupation with failure
Reluctance to simplify
Sensitivity to operations
Commitment to resilience
Deference to expertise"

US Fire service

I happened to come across the Fire Engineering website. It seems to contains some very valuable information.

I found this a paper Learning from Firefighter Fatalities very interesting. It is a discussion dating from 2004. I think it will be interesting to anyone working in a hazardous industry. Firefighters have to deal with emergencies far more often than most organisations. They have plenty of experience of what can go wrong.

The site includes a continually updating section notifying of Line of Duty Deaths. A very sobering read.

Firefighters drills is another section that looks interesting. You don't need to be a full time firefighter to be involved in emergency response.

Friday, April 01, 2011

Asda sold 12.9p petrol by mistake

BBC Website 1 April 2011

Drivers paid just 12.9p a litre for petrol after staff put a decimal point in the wrong place.

About 50 motorists stocked up on unleaded fuel at the petrol station in Rooley Lane, Bradford, West Yorkshire.

Drivers queued up to use the automatic card-payment pumps for about two hours until the mistake was spotted.

Some motorists also filled up petrol cans with the bargain fuel after word spread around the city.

Wednesday, March 16, 2011

Three Mile Island

This one of the classic human error examples. With the problems in Japan with the Fukushima Daiichi following the earth quake and tsunami, the BBC has given a good summary of what happened at 4am on Wednesday 28 March, 1979.

A relatively routine malfunction in a non-nuclear system caused a relief valve to open, releasing coolant from the core. The valve should have closed after a moment, but it didn't, and a large volume of coolant escaped.

There was no straightforward way for the plant's operators to know that the valve was the problem. No instrument on their control panel indicated whether it was open or closed.

Operators knew something was going wrong, though - alarms sounded and lights were flashing.

They mistakenly diagnosed the issue as being too much coolant in the pressuriser and shut off the emergency core cooling system, the first in a series of missteps that escalated the crisis.

"In not knowing what was going wrong and taking exactly the wrong action, they exacerbated the problem by orders of magnitude," says J Samuel Walker, a historian who worked for many years for the Nuclear Regulatory Commission (NRC), the US atomic agency and nuclear watchdog.

Operators worked furiously for days to minimize the meltdown.

It wasn't until 1985, when sophisticated cameras were sent into the core, that authorities understood the enormous extent of the meltdown.

The TMI disaster took over 12 years to clean up, at a cost of about $973m (£605m).

Fortunately, little radiation was released, and multiple studies have shown no serious health impacts.

There was no documented increase in cancers. Links between TMI and problems with livestock in the area, including deaths and reproductive issues, have not been proven.

Monday, March 14, 2011

Wales earned rub of the green

This is South Wales 14 March 2011

Referring to the Six Nations rugby match between Wales and Ireland played in Cardiff on 12 March.

Wales were awarded a try following a quick throw in that used a ball different to the one that went out of play.

"A quick throw in is not permitted if another person has touched the ball apart from the player throwing it in and an opponent who carried it into touch."

Referee Jonathan Kaplan consulted Allan before awarding the score, asking him: "Was it the correct ball?"

Allan replied in the affirmative, despite the fresh ball having been thrown to Rees by a ball-boy, meaning there were not one but two breaches of the IRB's rule.

There are bound to be questions asked about how an official on the international circuit can make such a blunder.

The more charitable will accept it as human error.

But some will want to see Allan punished, perhaps confined to Scottish domestic rugby for ever and a day — Hawick v Melrose, anyone?

Friday, March 11, 2011

Bayer CropScience Pesticide Waste Tank Explosion

Details of the investigation carried out by US Chemical Safety Board (CSB)of the Chemical runaway reaction leading to pressure vessel explosion on 28 August 2008 that kills two and injured eight. Available include:

* Final report
* Video on CSB website and on YouTube

The incident occurred during the restart of the methomyl unit after an extended outage to upgrade the control system and replace the original residue treater vessel. The Chemical Safety Board (CSB) investigation highlighted the following issues:

* Deviation from the written start-up procedures,
* Bypassing critical safety devices intended to prevent such a condition.
* Inadequate pre-startup safety review;
* Inadequate operator training on the newly installed control system;
* Unevaluated temporary changes,
* Malfunctioning or missing equipment, misaligned valves, and bypassed critical safety devices;
* Insufficient technical expertise available in the control room during the restart.
* Poor communications during the emergency between the Bayer CropScience incident command and the local emergency response agency confused emergency response organizations and delayed public announcements on actions that should be taken to minimize exposure risk

Pre-Startup Activities

Unlike the normal methomyl restart after a routine shutdown, the August restart involved operations personnel, engineering staff, and contractors working around the clock to complete the control system upgrade and residue treater replacement. Work included finalizing the software upgrades, modifying the work station, calibrating instruments, and checking critical components. Board operators were provided time at the methomyl work station so that they could familiarize themselves with the new control functions, equipment and instrument displays, alarms, and other system features. Other personnel were completing the residue treater replacement, reinstalling piping and components, and reconnecting the control and instrument wiring. These activities progressed in parallel with the ongoing Larvin unit operation.

The methomyl control system upgrade required a revision to the SOP to incorporate the changes needed to operate the methomyl unit with the new Siemens system, and to reformat the SOP to a computerized document. However, at the time of the incident the SOP revision remained incomplete; the operators were using an unapproved SOP that did not contain the new control system operating details.

Solvent Flush and Equipment Conditioning
Many of the subsystems in the methomyl unit required a solvent flush and nitrogen gas purge to clean and dry the systems before startup. These activities were critical to safely start the residue treater system as the feed, recirculation, and vent piping had been disconnected and a new pressure vessel had been installed. The solvent-only run was also needed to verify instrument calibrations, proper equipment operating sequences, and other operating parameters in the new DCS.
The staff flushed the process equipment with solvent to remove contaminants and water that might have gotten into the system during the outage. However, contrary to the SOP 25 the staff did not perform the residue treater solvent run.26 Operators reported that solvent flow restrictions upstream impeded completion of instrument calibrations because the proper adjustments could not be made at low flow rates. Even had the staff not needed to verify the control system function and operability, the solvent run was required to pre-fill the residue treater to the minimum operating level and to heat the liquid to the minimum operating temperature before adding the methomyl containing flasher bottoms feed.

2.2 Unit Restart
Although the operations staff acknowledged that management had not prescribed a specific deadline for resuming methomyl production, onsite stockpiles of methomyl necessary to make Larvin were dwindling. Unit personnel recognized the important role of methomyl in the business performance of the facility, and a recent increase in worldwide demand for Larvin created a significant, sustained production schedule. Methomyl-Larvin operating staff told CSB investigators that they looked
forward to resuming methomyl production and a return to the normal daily work routine after the long unit shutdown.
Operator logs documented the plan to start the MSAO (a.k.a. Oxime) unit Monday morning, August 25. Methomyl synthesis needed to begin shortly thereafter. However, critical startup activities were not completed, and the staff struggled with many problems as they attempted to bring each subsystem on line. To complicate the startup problems, process computer system engineers had not verified the
functionality of all process controls and instruments in the new control system.

Control System Upgrade
The introduction of the Siemens PCS7 control system significantly changed the interactions between the board operators and the DCS interface. The Siemens control system contained features intended to minimize human error such as graphical display screens that simulated process flow and automated icons to display process variables. But the increased complexities of the new operating system challenged operators as they worked to familiarize themselves with the system and units of measurement for process variables differed from those in the previously used Honeywell system.

Human interactions with computers are physical, visual, and cognitive. New visual displays and modified command entry methods, such as changing from a keyboard to a mouse, can influence the usability of the human-computer interface and impair human performance when training is inadequate. Operators told CSB investigators they were concerned with the slower command response times in the Siemens system and they talked about the methomyl process control issues they would face during the restart, which was much more difficult to control than the Larvin process. Board operators also told CSB investigators that the detailed process equipment displays in the DCS were difficult to navigate. Routine activities like starting a reaction or troubleshooting alarms would require operators to move between multiple screens to complete a task, which degraded operator awareness and response times.

The old system display and command entry was basically a spreadsheet, or line-item display. The new system used a graphical user interface (GUI) that displayed an illustrative likeness of the process and its various components (Figure 18). The board operator selected the device that needed to be changed. This made data entry clearer, but much slower. In the old system, board operators could change multiple process variables simultaneously, but they could select and change only one variable at a time in the Siemens system.

The new control system also changed how board operators monitored multiple pieces of equipment. The methomyl board operators’ station had five display screens available to monitor the methomyl processes and one display screen dedicated to process alarms. However, operating some methomyl equipment required the operators to use at least three of the five display screens. To simplify the operation, they asked the Siemens project engineers to add equipment overview screens to display multiple pieces of equipment. The board operators believed that the overview screens would provide more effective control of the unit; however, the screens were not available for the August 2008 startup.

Deadly Practices

Video from US Chemical Safety Board (CSB). Also available on YouTube.

It shows several accidents where vented natural gas has caused fires and explosions. They include the Kleen Energy power plant and a Hilton Hotel.

Thursday, March 10, 2011

What organisations can learn from bees

British Airways in-flight 'Business:life' magazine January 2011

Management consultant Michael O'Malley lists five ways that the way a bee hive works can teach us lessons for organisational success:

1. Pursue common goals. Bees have reproductive success and survival as their overarching goals and deal with instances where individuals attempt to pursue their own goals that are against the interests of the group, such as when worker bees lay eggs when only the queen has that right.

2. Protect the future. Bees proffer consistent and gradual gain and avoid boom and bust. Even if they find an exceptionally good patch of flowers, they don't all rush to harvest from that location. Instead, they always have scout bees looking for new opportunities, and when times get hard they invest more resources in scouting.

3. Distribute authority. Although the queen has a prominent role, this is mainly to keep the colony calm. Most decisions are made by the workers themselves, with the most important being made by those closest to the action that have access to the best information.

4. Safeguard against catastrophic loss. Bees achieve this in three ways. First, they maintain diversity (genetically), which means they do not all act the same way and so the colony is more able to deal with all situations it encounters. Second, they work flexibly so that different bees can step in to perform essential functions if those originally in that role are lost. Third, bees know they make mistakes but they choose to make errors that are least likely to have major consequences.

5. Avoid self-inflicted death. Bees need to keen the colony clean, and so expel those that may jeopardise this (i.e. have a contagious infection). This is like writing a reference for people who do not fit into an organisation, rather than keeping them to inflict damage.

Bees are a good example of an environmentally friendly organisation. They perform an essential role through pollination. They never take all the pollen or nectar from a flower, because that increases regeneration time.

Friday, March 04, 2011

Buncefield: Why did it happen?

Report published February 2011 and available at the HSE website.

Report sub heading "The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005"

On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol. The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. Eventually large quantities of petrol overflowed from the top of the tank. A vapour cloud formed which ignited causing a massive explosion and a fire that lasted five days.

The gauge had stuck intermittently after the tank had been serviced in August 2005. However, neither site management nor the contractors who maintained the systems responded effectively to its obvious unreliability. The IHLS needed a padlock to retain its check lever in a working position. However, the switch supplier did not communicate this critical point to the installer and maintenance contractor or the site operator. Because of this lack of understanding, the padlock was not fitted.
Having failed to contain the petrol, there was reliance on a bund retaining wall around the tank (secondary containment) and a system of drains and catchment areas (tertiary containment) to ensure that liquids could not be released to the environment. Both forms of containment failed. Pollutants from fuel and firefighting liquids leaked from the bund, flowed off site and entered the groundwater. These containment systems were inadequately designed and maintained.
Failures of design and maintenance in both overfill protection systems and liquid containment systems were the technical causes of the initial explosion and the seepage of pollutants to the environment in its aftermath. However, underlying these immediate failings lay root causes based in broader management failings:

Management systems in place at HOSL relating to tank filling were both deficient and not properly followed, despite the fact that the systems were independently audited.

Pressures on staff had been increasing before the incident. The site was fed by three pipelines, two of which control room staff had little control over in terms of flow rates and timing of receipt. This meant that staff did not have sufficient information easily available to them to manage precisely the storage of incoming fuel.

Throughput had increased at the site. This put more pressure on site management and staff and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff was made worse by a lack of engineering support from Head Office.
Cumulatively, these pressures created a culture where keeping the process operating was the primary focus and process safety did not get the attention, resources or priority that it required.

This report does not identify any new learning about major accident prevention. Rather it serves to reinforce some important process safety management principles that have been known for some time:
There should be a clear understanding of major accident risks and the safety critical equipment and systems designed to control them.
This understanding should exist within organisations from the senior management down to the shop floor, and it needs to exist between all organisations involved in supplying, installing, maintaining and operating these controls.
There should be systems and a culture in place to detect signals of failure in safety critical equipment and to respond to them quickly and effectively.
In this case, there were clear signs that the equipment was not fit for purpose but no one questioned why, or what should be done about it other than ensure a series of temporary fixes.
Time and resources for process safety should be made available.
The pressures on staff and managers should be understood and managed so that they have the capacity to apply procedures and systems essential for safe operation.
Once all the above are in place:
There should be effective auditing systems in place which test the quality of management systems and ensure that these systems are actually being used on the ground and are effective.
At the core of managing a major hazard business should be clear and positive process safety leadership with board-level involvement and competence to ensure that major hazard risks are being properly managed.

Why designers should pay more attention to ergonomic issues

Article in Engineer Live, March 2011. Interview with Gary Davis from Davis Associates

Gary reports a number of reasons why 'forward thinking' companies are taking ergonomics seriously. They include:

* Changing demographic; by the year 2020 half the adults in the UK will be aged 50 or over and the number of older people in the world will double to 1.2 billion by 2028. Inclusive design, in which products and services are usable by the widest possible range of people, therefore provides access to an expanding market.

* Usability is now considered to be a minimum requirement and the requirement is to make a product more pleasurable to use and to give it the 'wow!' factor. Ergonomics is becoming recognised as something that can create a commercial advantage

* Pressure from legislators. For example, ISO11064 Ergonomic design of control centres, Equal Treatment Framework Directive 2000/78/EC) and new EU Machinery Directive 2006/42/EC places a much greater emphasis on ergonomics than its predecessor).

* Ergonomics is a good way to protect a brand or strengthen it. If your products gain a reputation for being user-friendly, this can become important in markets where product differentiation is otherwise difficult."

* Conversely, the relatively new phenomenon of websites providing consumers with the opportunity to review products can damage brands if products are found to be unsatisfactory.

* If you consider ergonomics from the outset, you are less likely to have to make last-minute design changes

* If products are intuitive and comfortable to use, this reduces the need to provide after-sales support, plus it helps to minimise the number of product returns and warranty claims."

* Applying ergonomics to operator workstations can improve safety, reduce the opportunities for errors to be made, and raise productivity.

Quantifying the benefits of improved ergonomics can be difficult, but one area where this is done routinely is in website design, particularly for sales-orientated sites. Indeed, a specialist industry has evolved to improve website usability - which can be translated very rapidly into increased sales and, ultimately, profits that far outweigh the costs of the usability consultancy.

Elsewhere, of course, investing in ergonomics can reap rewards in the early stages of a project and at other points too - such as when alternative concepts are being assessed, and when pre-production units are available for user trials. Almost any level of ergonomics input can benefit a design, resulting in improved consumer satisfaction, appeal to a wider range of users, enhanced safety and so on.

Thursday, March 03, 2011

July 7/7 - Management jargon

Interesting comments made by Lady Justice Hallett (the coroner), reported on the BBC website.

"A succession of senior figures from across the capital's emergency services have appeared before Lady Justice Hallett - but on the final day of the inquests, she told them to use plain English, rather than refer to things like the "Conference Demountable Unit from the Management Resource Unit".

"Management jargon is taking over organisations," said Lady Justice Hallett. "When it comes to something like a major incident, people do not understand what the other person is.

"All you senior people from these organisations are allowing yourselves to be taken over by management jargon... You people at the top need to say 'We have to communicate with other people and we communicate with plain English'."

"I am sorry if that sounded like a rant but everybody who has been here for the last few months will know I have been building up to it."

Monday, February 28, 2011

7/7 inquests: 'Failings' hindered ambulance controllers

Ambulance controllers trying to respond to the 7/7 attacks worked in chaos amid a series of shortcomings, the inquests into the attacks have heard.

They include:

* Only one woman logged all the emergency calls and vital information was written on scraps of paper, it was revealed.

* Ambulance Service logger said: "I am not a trained typist, I use two fingers and a thumb."

* The employee in charge of updating the control room whiteboard could only reach halfway up it.

* Two of the people designated "crucial roles" at the start of the incident were not trained in the procedures for the so-called Gold Command - in overall control of the emergency.

* Staff transferring from their normal control room positions to the Gold disaster control room caused a delay because they had not logged off properly. That meant they were then unable to log on to the new system as calls from the four terror sites built up, causing a backlog.

* There were communications issues throughout. Radio channels were blocked and no feedback was coming in from ambulance bosses on the ground.

* There was so much information coming in that control room staff were unable to prioritise it effectively.

* Failed radio and mobile phone networks meant there were serious delays in dispatching paramedics to bomb sites.

Friday, February 25, 2011

No easy solutions for alarm fatigue

Article at Boston.com by Liz Kowalczyk on 14 February 2011

77 year old Madeline Warner died at UMass Memorial Medical Center in Worcester USA died after nurses failed to respond to an alarm that sounded for about 75 minutes, signalling that her heart monitor’s battery needed to be replaced, state investigators found.

The article explains the problems in hospitals with large numbers of alarms that personnel are required to respond to. The whole industry is finding it difficult to come up with a solution. Options include:

1. Improving monitor technology, to sharply decrease the number of false alarms, which some studies have shown exceed 85 percent. New machines would simultaneously sense multiple measures of a patient’s health to more accurately gauge whether a patient is really in crisis.

2. Hiring more nurses, and assigning some to do nothing but watch monitors for alarms.

3. Strengthening voluntary industry standards or federal rules for monitor design and use, such as requirements for how loud alarms should be, or how long monitors should delay sounding an alarm to ensure an apparent problem is real and reduce false alarms.

4. Implement new guidelines for doctors on when to order cardiac monitoring for patients, and how often they must recheck their orders. When technology is readily available doctors end up ordering it for patients who might not benefit. But persuading doctors to put significantly fewer patients on monitors will be a huge challenge, because monitors can be an important tool for alerting staff to problems.

The hospital has already made changes to reduce the likelihood of alarms being missed. Low-battery warnings now appear on the pager or cellphone of the patient’s nurse. If he or she does not respond within a minute, a page goes to all nurses on the unit — as do alarms for potential life-threatening changes in patients. Also, the hospital has replaced cheap $1 leads for the wires that run from a patient’s chest to the monitor with $14 leads that rarely fall off and significantly reducing “leads-off’’ alarms.

GE Healthcare, a monitor maker, is testing similar technology for intensive care units. The company said the new software significantly reduces the number of false heart rate alarms because it uses information from a variety of physiological signals to evaluate patients, rather than just cardiac information. At one hospital, “the technology resulted in an 89 percent reduction in false asystole alarms’’ (asystole refers to a state of no cardiac activity), compared with a traditional cardiac monitor, the company said in a written statement. But this approach is probably only likely to work in intensive care.

Mother dies after nurse makes error administering drug

Article from the Daily Mail 23 February 2011

In true Daily Mail style the story is hyped under the title "Mother-of-four dies after blundering nurse administers TEN times drug overdose"

80 year old Arsula Samson died on 14 March 2010 at Good Hope Hospital, Birmingham after she was given an overdose of deadly potassium chloride.

According to the inquest staff nurse Lisa Sparrow wrongly administered 50ml of the drug over half an hour instead of over five hours, the inquest heard.

Instead of pressing the 10ml per hour button, the nurse admitted tapping in 100ml per hour on the drug infusion pump.

Staff nurse Sparrow signed out the medication from the controlled drug stock cupboard with staff nurse Susan Smith, as two people were supposed to administer and check the drug together to avoid any errors under hospital policy.

But nurse Smith left nurse Sparrow to give the drug on her own when the error happened. The coroner said that nurse Sparrow's gross failure resulted in the overdose and was a direct cause for the death while a second failure was that nurse Smith did not oversee the drug being given.

Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death

Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death

Nurse Sparrow told the inquest she had not expected nurse Smith to watch her give the potassium as 'no-one ever did'.

An official Trust report said no error was found with the infusion pump and investigators ruled the death was due to 'individual, human error'.

A Trust action plan after the death saw new infusion pumps and software that reduce the risk of error brought into all wards, medical staff retrained and warned over the dangers of potassium chloride and advice on the importance of a second nurse witnessing medication being given.

Birmingham coroner Aidan Cotter gave a verdict of accidental death to which neglect contributed.

Sunday, February 20, 2011

Vietnam boat sinking: Human error blamed, two arrested

BBC Website 20 February 2011

Human error was to blame for the sinking of a tourist boat in Vietnam which killed 12 people, including one Briton, Vietnamese police have said.

Quang Ninh police spokesman Le Thanh Binh said a valve that allowed water to come into the boat to cool the engine had been left open overnight.

Stuart McCormick, 30, from Irvine, Ayrshire, died with 11 holidaymakers and a Vietnamese guide in Halong Bay.

The vessel's captain and a crew member have been arrested.

The wooden boat was touring the Unesco World Heritage Site in Quang Ninh province when it went down.

Speaking to Associated Press news agency, Mr Binh said: "The initial police investigation showed that the man in charge of the boat engine forgot to close the valve that allowed water in to cool the engine before he, the captain and other crew went to bed."

The engine was turned off, preventing a pump from running to push the water out.

By the time the captain and crew woke to find the boat filled with water, it was too late and the vessel sank quickly, he said.

Thursday, February 17, 2011

Human factors performance indicators

Published by Energy Institute in 2010 and available from the EI Website

The report explores what performance indicators are and how they are used, and proposes a methodology for selecting human factors performance indicators for each of the HSE top 10 key human factors issues. The report also provides a list of example human factors performance indicators which are already being used by industry or which could potentially be used.

Sunday, February 06, 2011

Slug kills teen girl driver

Articles in The Sun and Express on 31 January 2011

Katie Dagley, 19, was killed in a head-on collision on a brige at Alvecote, near Tamworth, West Midlands.

The bridge was single track, with traffic lights to only allow vehicles to travel one way at a time. An investigation found that the traffic lights had malfunctioned 20 minutes before the crash. There was a trail across the circuit board and it had short-circuited it.

The driver of the, James Cope, 18, told how he saw Katie's car but did not have time to brake.

Friday, February 04, 2011

Proposed regulation by FAA closes human factors loophole

Article on Flightglobal website by John Croft 2 February 2011

The US Federal Aviation Authority (FAA) is proposing to close a human factors loophole in the regulations governing the certification of transport category aircraft with increasingly advanced-technology integrated flight decks.

In a notice of proposed rulemaking (NPRM) to be issued on 3 February, the agency calls for creating more explicit requirements for "design attributes" related to "managing and avoiding" pilot errors, including being able to detect and recover from keypad errors.

"In hindsight of analysis of accidents, incidents or other events of interest, these deviations might include: an inappropriate action, a difference for what is expected in a procedure, a mistaken decision, a slip of the fingers in typing, an omission of some kind, and many other examples," says the agency in the NPRM.

Thursday, February 03, 2011

Safety on the Front Lines

Article in Aviation Week by Heather Baldwin on 1 February 2011

I'm a bit surprised that the article is written as if human factors is a new idea in the aviation industry, but it does give some good examples of problems. For example taken from a survey of maintenance managers:

* More than half think their employees complete jobs despite the non-availability of specified tools or equipment.
* 16% said they believe their employees have signed off for uncompleted work due to limited time or resources.
* One in 10 managers admitted their line supervisors would approve a mechanic’s actions if he didn’t follow procedures in order to get an aircraft out.
* 26% of technicians believe that their immediate bosses would approve of their actions if they did not follow procedures in order to speed up their work on an aircraft

"An error is rarely the sole fault of an individual; rather, it often is driven by organizational pressures, expectations and unwritten policies."

A technician was fired because, in violation of regulations, he walked an aircraft back solo one night and damaged it. On the surface, it might appear to be the poor judgment of a single individual. In fact, the organization where this occurred had cut back so severely due to cost pressures that it didn’t have the manpower for two wing walkers on the midnight shift. Consequently, under pressure to get the work done, technicians routinely moved airplanes with one walker.

"Maintenance errors are the consequences of the processes, decisions and culture established by the organization."

JetBlue Airways has many safety initiatives including the "Pocket Session" that requires senior leaders to get out routinely and meet with front-line workers. No one is ever punished for bringing forward a safety concern, employees are encouraged and expected to submit safety reports on all potentially unsafe situations they encounter. Examples of unsafe situations reported include "ramp lighting" and "running engines with passengers onboard." JetBlue says its "injuries, ground damages and other measures, has been better year over year almost every year since we’ve been in operation." "From 2009 to 2010, the injury rate for Tech Ops dropped 83%."

I'm slightly concerned that the article is referring to reduced injury rates at JetBlue with no consideration of whether this is relevant to flight safety.

Thursday, January 13, 2011

NASA Rolls Out New Technology in 3D Simulation

Article from Industrial Week 12 January 2011 by Peter Schmitt and Les Goldberg

In the past, NASA's design effort has been focussed on flight operations. As a result, very little consideration was given to manufacturing processes or human factors engineering. The argument was "If you're spending money on ground operations, you're not spending it on in-space operations."

The scenarios that resulted from this included:

* A spacecraft would be built without any thought given to how it would be transported to the launch site
* Ground operations were only developed after the spacecraft had been built and transported to the launch site
* Engineers had to develop "work-arounds" for nearly every task required to prepare the vehicle for launch, making the space shuttle very expensive to operate.

The article says that the availability of 3D digital manufacturing software to simulate operations at all stages of the operation have led to significant improvement. I think I would argue that, whilst the technology must have helped, it would have required a significant cultural change to start thinking about human factors for the whole project.

Examples of improvements that have been achieved include:

* Simulating a welding process identified that the welding head would collide with other hardware. Parts were changed during the design, avoiding problems during manufacture.
* Simulating how a person would interact with a vehicle to secure it to a barge for transport allows features to be incorporated to ensure that humans have access to, and can reach the hardware they need to perform tie-down operations.
* Simulating a two crane lifting operation allowed detailed instructions to be developed prior to the operation, validating its safety.

Introducing these tools at the outset of a program reduces manufacturing and ground operations costs, and fundamentally changes the way NASA engineers operate.

It has improved relationships between engineers at different facilities. Money saved on manufacturing and ground operations can be spent on exploration and in-flight activities.

LSE says human error, not sabotage, caused crash

Article from Reuters 11 January 2011 by Luke Jeffs

Having initially citing "suspicious circumstances" and calling the police, the LSE has now announced that "The investigation found the incident was the result of human error and the incident has now been closed." No further details were provided.

I am not sure if we are supposed to be reassured by this statement. Have any system or organisational changes been made to prevent a recurrence? Or have they just reprimanded the human who made the error?

Tuesday, January 11, 2011

Oil Spill Commission - Final Report

Published 11 January 2011 and available at http://www.oilspillcommission.gov/sites/default/files/documents/DEEPWATER_ReporttothePresident_FINAL.pdf

Publishing a report that is nearly 400 pages long, it may be concluded that the Commission is trying to cover up information by overwhelming us with data. The early release of a single chapter a week earlier may be further evidence of some slight of hand going on.

The report reads almost like a novel in places, and includes a lot of history of the oil industry going right back to the 1890s. The fact that the Commission chose to title the report "Deep Water" does little to reassure me that we are receiving an objective or useful view of what caused the disaster, and how it can be avoided in the future.

I've only skimmed through the report. Below are a few sections I have picked out that appear to be particularly interesting or useful. I have included page numbers so that you can find the sections in the report if you wish.

The Blow Out Preventer did not work, and I was aware that there were some issues regarding previous modifications. This is covered on Page 137 of the report:

As the National Incident Command took shape in early May, BP’s efforts to stop the flow of oil continued to focus on actuating the BOP, which BP still believed was the best chance of quickly shutting in the well. These efforts were plagued by engineering and organizational problems. For instance, it took nearly 10 days for a Transocean representative to realize that the stack’s plumbing differed from the diagrams on which BP and Transocean were relying, and to inform the engineers attempting to trigger one of the BOP’s rams through a hydraulic panel that they had been misdirecting their efforts.

(Without properly recording the change, Transocean had reconfigured the BOP; the panel that was supposed to control that ram actually operated a different, “test” ram, which could not stop the flow of oil and gas. BP Vice President Harry Thierens, who was BP’s lead on BOP interventions, stated afterward that he was “quite frankly astonished that this could have happened.”) While this and other problems delayed BP’s efforts, the flow of oil and sand continued to wear down the BOP’s parts, making closure more difficult.

One thing I wanted from the report was clear indication of how bad the environmental damage really was as a result of the oil spill. The report suggests that it was far less than was often suggested. In fact it appears to me that American politicians may have been tempted to exaggerate in an effort to put more pressure on BP.

Page 155 of the report includes the following from a Gulf resident. "What’s funny,” Lindsay said, “is we only had about three bad weeks where oil was washing on shore and BP was staging clean-up on the beach. That was in June. The rest of the summer the beaches were pretty much clean but folks still didn’t come down.”

The report gives some idea of the the impact on nature. There does not seem to be anything like a clear picture, partly because conditions prior to the disaster where not known in any detail. Page 174 of the report includes the following.

"The Deepwater Horizon oil spill immediately threatened a rich, productive marine ecosystem. To mitigate both direct and indirect adverse environmental impacts, BP and the federal government took proactive measures in response to the unprecedented magnitude of the spill. Unfortunately, comprehensive data on conditions before the spill—the natural “status quo ante” from the shoreline to the deepwater Gulf—were generally lacking. Even now, information on the nature of the damage associated with the released oil is being realized in bits and pieces: reports of visibly oiled and dead wildlife, polluted marshes, and lifeless deepwater corals. Moreover, scientific knowledge of deepwater marine communities is limited, and it is there that a significant volume of oil was dispersed from the wellhead, naturally and chemically, into small droplets. Scientists simply do not yet know how to predict the ecological consequences and effects on key species that might result from oil exposure in the water column, both far below and near the surface.

Much more oil might have made landfall, but currents and winds kept most of the oil offshore, and a large circulating eddy kept oil from riding the Loop Current toward the Florida Keys. Oil-eating microbes probably broke down a substantial volume of the spilled crude, and the warm temperatures aided degradation and evaporation—favorable conditions not present in colder offshore energy regions. (Oil-degrading microbes are still active in cold water, but less so than in warmer water.) However widespread (and in many cases severe) the natural resource damages are, those observed so far have fallen short of some of the worst expectations and reported conjectures during the early stages of the spill. So much remains unknown that will only become clearer after long-term monitoring of the marine ecosystem. Government scientists (funded by the responsible party) are undertaking a massive effort to assess the damages to the public’s natural resources. Additionally, despite significant delays in funding and lack of timely access to the response zone, independent scientific research of coastal and marine impacts is proceeding as well.

Page 176 of the report

The oil that made landfall was fairly “weathered,” consisting of emulsions of crude oil and depleted of its more volatile components. More than 650 miles of Gulf coastal habitats— salt marsh, mudflat, mangroves, and sand beaches—were oiled; more than 130 miles have been designated as moderately to heavily oiled. Louisiana’s fragile delta habitats bore the brunt of the damage, with approximately 20 additional miles of Mississippi, Alabama, and Florida shorelines moderately to heavily oiled. Light oiling and tar balls extended east to Panama City, Florida. Except for occasional tarballs, Deepwater Horizon oil never reached Texas or the tourism centers along the southwest Florida coast.

Page 189
In early May, to show that their pristine beaches were still sugary white, “We started filming daily and sometimes twice daily a video for YouTube called Shore Shots. It involved one of my employees standing in front of the camera and showing the Gulf of Mexico and the lack of oil despite being told otherwise. . . . It was not always well received. We were called liars when we said we didn’t have oil on the beaches and told we were poisoning people with Corexit for our own greedy gain. It was definitely tough. “By July the oil was here. No way I could prevent it from coming on – revenue dropped significantly. By August it was awful. No one, I mean no one, believed that we weren’t covered in oil similar to the Exxon Valdez.”

Is it a coincidence that negative information about Transocean and Haliburton is hidden over 200 pages into the report?

Page 224 of the report shows that Transocean's culture and systems may have had some serious weaknesses.

A survey of the Transocean crew regarding “safety management and safety culture” on the Deepwater Horizon conducted just a few weeks before the accident hints at the organizational roots of the problem. The research, conducted at Transocean’s request, involved surveys and interviews with hundreds of employees onshore and on four rigs, including Deepwater Horizon, which was surveyed from March 12 to March 16. The reviewers found Deepwater Horizon “relatively strong in many of the core aspects of safety management.” But there were also weaknesses. Some 46 percent of crew members surveyed felt that some of the workforce feared reprisals for reporting unsafe situations, and 15 percent felt that there were not always enough people available to carry out work safely. Some Transocean crews complained that the safety manual was “unstructured,” “hard to navigate,” and “not written with the end user in mind”; and that there is “poor distinction between what is required and how this should be achieved.” According to the final survey report, Transocean’s crews “don’t always know what they don’t know. [F]ront line crews are potentially working with a mindset that they believe they are fully aware of all the hazards when it’s highly likely that they are not.”

Also, on the same Page 224 there appears to be some really damming information about Halibuton's cementing

Halliburton prepared cement for the Macondo well that had repeatedly failed Halliburton’s own laboratory tests (see Chapter 4). And then, despite those test results, Halliburton managers onshore let its crew and those of Transocean and BP on the Deepwater Horizon continue with the cement job apparently without first ensuring good stability results.

Halliburton also was the cementer on a well that suffered a blowout in August 2009, in the Timor Sea off Australia. The Montara rig caught fire and a well leaked tens of thousands of barrels of oil over two and a half months before it was shut down. The leak occurred because the cement seal failed, the government report into the accident found. However, the report said it would not be appropriate to criticize Halliburton, because the operator “exercised overall control over and responsibility for cementing operations.” The inquiry concluded that “Halliburton was not required or expected to ‘value add’ by doing
more than complying with [the operator’s] instructions.” In this, Montara offers yet another example of a lack of communication between operators and service providers and of the gaps between the silos of expertise that exist in the deepwater oil and gas industry.

The final section I have copied here seems to suggest that that American Petroleum Institute (API) were to blame for poor regulation. I'm not sure I quite follow the logic behind the text on Page 228 of the report

For years, API also led the effort to persuade the Minerals Management Service not to adopt a new regulatory approach—the Safety and Environmental Management System (SEMS)—and instead has favored relying on voluntary, recommended safety practices.

Safety and environmental management systems are used in similar forms in other parts of the world and many credit them with the better safety records achieved outside U.S. waters (see Chapter 3). Beginning early in the last decade, the trade organization steadfastly resisted MMS’s efforts to require all companies to demonstrate that they have a complete safety and environmental management system in addition to meeting more traditional, prescriptive regulations—despite the fact that this is the direction taken in other countries in response to the Piper Alpha rig explosion in the late 1980s. Indeed, many operators in the Gulf were used to this safety-based approach on their rigs in the North Sea and Canada. It was not until this past September—after the Macondo blowout—that the Department of the Interior was finally able to announce a new, mandatory Safety and Environmental Management System: almost two decades after the approach was adopted in the United Kingdom, where it is called the “safety case.” Moreover, API opposed revisions to the incident reporting rule that would have helped better identify safety risks