International Law Office website 27 June 2011
An Italian court has sentenced the chief executive officer (CEO) of a company to 16 years' imprisonment for an offence related to the deaths of seven employees. This is the first such case in Italy in which a CEO has been found guilty of homicide, rather than manslaughter. The court found the company liable under Law 231/2001 and ordered it to pay a fine of €1 million. In addition, it confiscated a further €800,000 and banned the company from receiving public funds for six months.
The case concerned an incident at a factory operated by the company ThyssenKrupp. On the night of December 6 2007 a fire broke out on the production line and could not be extinguished because of a lack of fire extinguishers and the absence of other safety features. Seven workers were killed.
At trial, the prosecutor claimed that ThyssenKrupp's senior management had decided not to invest in health and safety at the factory, since they had decided to relocate production to another site. Therefore, the management knew that it was accepting a risk that a serious accident could occur and was aware of the potential legal consequences of the decision.
The prosecutor argued that if a senior manager decides to reduce investment in health and safety, he or she is aware that there is a high probability of a serious accident. If an accident occurs and someone dies as a result, the manager in question must be deemed guilty of homicide. Although the grounds have not yet been published, the decision indicates that the court appears to have agreed with this argument.
Wednesday, June 29, 2011
Friday, June 24, 2011
FDA's new guidance tackles device usability, safety
http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM259760.pdf
Osprey pilots were blameless victims, widow says
Article at newsobserver.com by Marth Quillin and Bob Cox on 19 June 2011
On 8 April 2000 a newly developed V-22 Osprey crashed during a 'mock exercise,' killing those on board. This is an aircraft with tilting rotors, which can land and take off like a helicopter but fly more like a fixed wing aircraft. Following the crash the Marine Corps investigation concluded that "This mishap appears not to be the result of any design, material or maintenance factor specific to tilt-rotors. Its primary cause, that of a MV-22 entering a Vortex Ring State (Power Settling) and/or blade stall condition, is not peculiar to tilt rotors. The contributing factors to the mishap, a steep approach with a high rate of descent and slow airspeed, poor aircrew coordination and diminished situational awareness, are also not particular to tilt rotors." And in announcing the findings of the report, the Marine Corps said in a press release that it "confirms that a combination of 'human factors' caused the April 8 crash of an MV-22 Osprey tilt-rotor aircraft that killed 19 Marines near Marana, Ariz."
However, the families of those who died feel the language used by the Marine Corps was intended to put most of the blame for the accident on the pilots. They feel that the tragic accident "was the direct result of the crewmen being tasked with an insurmountable, premature mission in a dangerously immature aircraft and not "human factors." They feel the fact that another fatal accident occurred later that year and the aircraft had to be grounded for 18 months for further testing and development back up their opinion.
These were experienced pilots who believed in the Osprey project. In the exercise, pilots were to rescue a group of "hostages" and bring them back to base. The task introduced several variables: night flight, a heavy load of Marines and their gear, and a different environment from the coastal one where the pilots had done most of their training. But as the mission unfolded that night in Arizona, not everything went according to plan. A computer malfunctioned in the lead plane, the pilots decided to continue with the exercise and try to reset the computer after landing. As they approached the landing zone, the planes were too high and were hit with an unexpected tailwind. They began a steep descent aiming for the runway - a piece of cake for an experienced military helicopter pilot. The pilots, doing as they were trained, were following the lead plane, but got out of position and tried to manoeuvre back into line. They had little forward airspeed, and the rotors began to stall, losing the lift that holds the aircraft in vertical flight. Just 200 feet above the ground, in a span of about three seconds, the aircraft rolled uncontrollably to the right and turned upside down before slamming into the ground.
The pilots had gotten into an aerodynamic condition called "vortex ring state" or "blade stall." The lead plane may have had the same problem, but it simply landed very hard, crushing the landing gear and skidding several hundred feet and off the runway.
The family feel there were so many factors in the accident that the pilots should exonerated so that the dishonour can be removed.
I think the comments left on the article make some great points:
* "This aircraft was called the widow maker. This Crash was not an isolated incident."
* "Given the many lessons learned from the tragedy that claimed the lives of the aircrew and the passengers, it seems reasonable to assume that had they not been the ones to experience this mishap, another crew and aircraft would have at another time. Clearly none of the pilots involved in the mishap understood the hazards they faced that evening, or both lead and trail aircraft would certainly have gone around for another pass."
* "If Boeing felt compelled to add warning devices to the cockpit to alert pilots, it sounds that the greatest cause of the crash may well have been the initial design. I hope that the powers that be might eventually reconsider."
On 8 April 2000 a newly developed V-22 Osprey crashed during a 'mock exercise,' killing those on board. This is an aircraft with tilting rotors, which can land and take off like a helicopter but fly more like a fixed wing aircraft. Following the crash the Marine Corps investigation concluded that "This mishap appears not to be the result of any design, material or maintenance factor specific to tilt-rotors. Its primary cause, that of a MV-22 entering a Vortex Ring State (Power Settling) and/or blade stall condition, is not peculiar to tilt rotors. The contributing factors to the mishap, a steep approach with a high rate of descent and slow airspeed, poor aircrew coordination and diminished situational awareness, are also not particular to tilt rotors." And in announcing the findings of the report, the Marine Corps said in a press release that it "confirms that a combination of 'human factors' caused the April 8 crash of an MV-22 Osprey tilt-rotor aircraft that killed 19 Marines near Marana, Ariz."
However, the families of those who died feel the language used by the Marine Corps was intended to put most of the blame for the accident on the pilots. They feel that the tragic accident "was the direct result of the crewmen being tasked with an insurmountable, premature mission in a dangerously immature aircraft and not "human factors." They feel the fact that another fatal accident occurred later that year and the aircraft had to be grounded for 18 months for further testing and development back up their opinion.
These were experienced pilots who believed in the Osprey project. In the exercise, pilots were to rescue a group of "hostages" and bring them back to base. The task introduced several variables: night flight, a heavy load of Marines and their gear, and a different environment from the coastal one where the pilots had done most of their training. But as the mission unfolded that night in Arizona, not everything went according to plan. A computer malfunctioned in the lead plane, the pilots decided to continue with the exercise and try to reset the computer after landing. As they approached the landing zone, the planes were too high and were hit with an unexpected tailwind. They began a steep descent aiming for the runway - a piece of cake for an experienced military helicopter pilot. The pilots, doing as they were trained, were following the lead plane, but got out of position and tried to manoeuvre back into line. They had little forward airspeed, and the rotors began to stall, losing the lift that holds the aircraft in vertical flight. Just 200 feet above the ground, in a span of about three seconds, the aircraft rolled uncontrollably to the right and turned upside down before slamming into the ground.
The pilots had gotten into an aerodynamic condition called "vortex ring state" or "blade stall." The lead plane may have had the same problem, but it simply landed very hard, crushing the landing gear and skidding several hundred feet and off the runway.
The family feel there were so many factors in the accident that the pilots should exonerated so that the dishonour can be removed.
I think the comments left on the article make some great points:
* "This aircraft was called the widow maker. This Crash was not an isolated incident."
* "Given the many lessons learned from the tragedy that claimed the lives of the aircrew and the passengers, it seems reasonable to assume that had they not been the ones to experience this mishap, another crew and aircraft would have at another time. Clearly none of the pilots involved in the mishap understood the hazards they faced that evening, or both lead and trail aircraft would certainly have gone around for another pass."
* "If Boeing felt compelled to add warning devices to the cockpit to alert pilots, it sounds that the greatest cause of the crash may well have been the initial design. I hope that the powers that be might eventually reconsider."
Thursday, June 09, 2011
Pilot's bereavement 'crash factor'
Belfast Telegraph 9 June 2011
A helicopter crash involving a police air crew assisting at the scene of an earlier accident may have happened because the pilot was coping with a recent family bereavement, a report has said. The helicopter was destroyed but the occupants suffered only minor injuries.
The pilot, who had completed all the helicopter and role training required by the operator, arrived in Northern Ireland from England two days before the accident, for the start of a five-day period of duty.
"Immediately beforehand, he had suffered a family bereavement. He did not report this to his company and considered on the day that he was fit for flying duty. However, when the pilot subsequently informed the AAIB of the fact, he thought it possible that it may have been a contributory factor in the accident."
The report says that the pilot lost control of the helicopter, which was engaged on a task for the Police Service of Northern Ireland, while manoeuvring at low speed to approach a hilltop landing site in quite strong wind conditions. It descended rapidly before striking the ground short of the point of intended landing and passing through a substantial stone wall.
"The investigation determined that an error of judgment or perception led the pilot to attempt a downwind approach. A combination of human factors was thought to have contributed to the accident," the report said.
The report quoted experts who said the death of a close family member has been found to lead to higher levels of stress than any other experience, with the exception of the death of a spouse or partner, and that such stress will likely to cause loss of concentration and performance. The task to be carried out on the day of the accident, although demanding, was within the capabilities of the pilot.
"However, although the effects on an individual of a recent family bereavement cannot be measured, it is considered that this was probably the most significant contributory factor in the cause of the accident," the report said.
A helicopter crash involving a police air crew assisting at the scene of an earlier accident may have happened because the pilot was coping with a recent family bereavement, a report has said. The helicopter was destroyed but the occupants suffered only minor injuries.
The pilot, who had completed all the helicopter and role training required by the operator, arrived in Northern Ireland from England two days before the accident, for the start of a five-day period of duty.
"Immediately beforehand, he had suffered a family bereavement. He did not report this to his company and considered on the day that he was fit for flying duty. However, when the pilot subsequently informed the AAIB of the fact, he thought it possible that it may have been a contributory factor in the accident."
The report says that the pilot lost control of the helicopter, which was engaged on a task for the Police Service of Northern Ireland, while manoeuvring at low speed to approach a hilltop landing site in quite strong wind conditions. It descended rapidly before striking the ground short of the point of intended landing and passing through a substantial stone wall.
"The investigation determined that an error of judgment or perception led the pilot to attempt a downwind approach. A combination of human factors was thought to have contributed to the accident," the report said.
The report quoted experts who said the death of a close family member has been found to lead to higher levels of stress than any other experience, with the exception of the death of a spouse or partner, and that such stress will likely to cause loss of concentration and performance. The task to be carried out on the day of the accident, although demanding, was within the capabilities of the pilot.
"However, although the effects on an individual of a recent family bereavement cannot be measured, it is considered that this was probably the most significant contributory factor in the cause of the accident," the report said.
Monday, May 16, 2011
Book priced at $23,698,655.93 on Amazon
A post on Michael Eisen's blog about genomes on 22 April 2011.
An unusual but great example of the potential pitfalls of automation.
Michael wanted to buy a book by Peter Lawrence called The Making of a Fly. He went onto Amazon. Although it was out of print 17 copies were listed for sale: 15 used from $35.54, and 2 new from $1,730,045.91 (+$3.99 shipping).
Michael knew the price of over a million dollars had to be wrong, but he was quite sure it was from legitimate sellers. However, he was even more surprised when the next time he looked the price was nearly $2.8 million. The price peaked on 18 April 2011 at $23,698,655.93 (plus $3.99 shipping).
The explanation is as follows (taken from The Risks Digest)
* Seller A didn't really have the book, but planned to buy it from
Seller B if someone placed an order. They had a better feedback
record than B, so someone might buy it from A even at a higher
price, and had programmed their price to be 27.0589% higher than A's,
so they'd make a profit.
* Seller B, meanwhile, was trying to ensure they just barely had the
lowest price, and had programmed their price to be 0.17% lower than
their competition.
* Both prices were updated automatically once a day—thus rising
exponentially until somebody noticed.
An unusual but great example of the potential pitfalls of automation.
Michael wanted to buy a book by Peter Lawrence called The Making of a Fly. He went onto Amazon. Although it was out of print 17 copies were listed for sale: 15 used from $35.54, and 2 new from $1,730,045.91 (+$3.99 shipping).
Michael knew the price of over a million dollars had to be wrong, but he was quite sure it was from legitimate sellers. However, he was even more surprised when the next time he looked the price was nearly $2.8 million. The price peaked on 18 April 2011 at $23,698,655.93 (plus $3.99 shipping).
The explanation is as follows (taken from The Risks Digest)
* Seller A didn't really have the book, but planned to buy it from
Seller B if someone placed an order. They had a better feedback
record than B, so someone might buy it from A even at a higher
price, and had programmed their price to be 27.0589% higher than A's,
so they'd make a profit.
* Seller B, meanwhile, was trying to ensure they just barely had the
lowest price, and had programmed their price to be 0.17% lower than
their competition.
* Both prices were updated automatically once a day—thus rising
exponentially until somebody noticed.
Thursday, May 12, 2011
Make Them Uncomfortable (Avoiding Complacency)
Article from Aviation Week by Heather Baldwin on 11 May 2011
Complacency occurs when people become comfortable in their jobs and begin taking shortcuts, such as not using checklists or using an out-of-date tool rather than making the trek to get a serviceable replacement. It spreads because see someone taking a short cut and think they can get away with it.
Complacency is most likely to occur in job that require repetition. Maintenance technicians are particularly vulnerable because they are often performing similar tasks and end up working in automatic. This narrows their focus and leads to a loss of situational awareness. It is a classic example of where lots of training and experiences leads to problems.
According to Dr. Terry Tolleson of Blue Tuna Training and Documentation "It’s not about skill level; it’s about mental attentiveness." When you’ve done something again and again, "There is a tendency to see what you expect to see." This can lead to very serious errors.
Complacency is one of the harder problems to identify because it is intangible. But there can be warning signs including people not following their own manuals, not completing documentation as it should be and shelf-life sensitive items not being managed in a shop.
Technician workload can have a big influence. Mental underloading and mental overloading can both lead to complacency. Keeping people mentally stimulated but not overloaded is important. Also, creating professional development plans that continually challenge people with new responsibilities and new skill development opportunities. In other words, getting people out of their comfort zone.
Talking about complacency can help.
Complacency occurs when people become comfortable in their jobs and begin taking shortcuts, such as not using checklists or using an out-of-date tool rather than making the trek to get a serviceable replacement. It spreads because see someone taking a short cut and think they can get away with it.
Complacency is most likely to occur in job that require repetition. Maintenance technicians are particularly vulnerable because they are often performing similar tasks and end up working in automatic. This narrows their focus and leads to a loss of situational awareness. It is a classic example of where lots of training and experiences leads to problems.
According to Dr. Terry Tolleson of Blue Tuna Training and Documentation "It’s not about skill level; it’s about mental attentiveness." When you’ve done something again and again, "There is a tendency to see what you expect to see." This can lead to very serious errors.
Complacency is one of the harder problems to identify because it is intangible. But there can be warning signs including people not following their own manuals, not completing documentation as it should be and shelf-life sensitive items not being managed in a shop.
Technician workload can have a big influence. Mental underloading and mental overloading can both lead to complacency. Keeping people mentally stimulated but not overloaded is important. Also, creating professional development plans that continually challenge people with new responsibilities and new skill development opportunities. In other words, getting people out of their comfort zone.
Talking about complacency can help.
Friday, April 29, 2011
Behavioural safety - a briefing for workplace representatives
Published by the TUC May 2010 and available here
This is a short document aimed at union representatives. It appears to me to give a pretty balanced warning that behavioural safety programs are not always implemented well, and can result in inappropriate interventions that aim to change worker behaviours' without addressing systems failures.
This is a short document aimed at union representatives. It appears to me to give a pretty balanced warning that behavioural safety programs are not always implemented well, and can result in inappropriate interventions that aim to change worker behaviours' without addressing systems failures.
Human factors to blame for fatal crash of Air India Express flight from Dubai
Article from Arabian Aerospace published 26 April
An inquiry into the The Air India Express IX812 accident at Mangalore airport on May 22 2010 has identified a number of human factors causes. Only eight of the 166 people on board survived.
The Flight-data recorder shows the aircraft crossed the runway threshold at 200ft rather than at the prescribed 50 feet and much faster. As a result it didn’t touch down until 1600 metres along the runway leaving just 860 metres, which meant it overran the runway. The aircraft's right wing collided with an antenna and the aircraft dropped off the edge of a steep gorge.
Investigators say that cockpit voice recordings recorded typical breathing patterns of deep sleep from the Captain, lasting for 1h 28min, until just 21min before the accident. These recording indicated that the captain slept for at least 1h 40min.
During preparations for landing the co-pilot suggested three times that they should "go-around," which was ignored by the captain, and then erroneously confirmed the aircraft was on the correct approach following pressure by the captain to do so.
A contributing factor was that the airport radar was not working and so the landing was conducted on instruments only.
Report suggest that the captain and co-pilot had fallen out several weeks before the accident. This may be why co-pilot did not wake the captain earlier in the flight and contributed to poor communication between the pair. Also, that "prolonged sleep by the captain, particularly during the overnight circadian low period, could have led to sleep inertia and possibly impaired judgement over the approach shortly after he woke."
An inquiry into the The Air India Express IX812 accident at Mangalore airport on May 22 2010 has identified a number of human factors causes. Only eight of the 166 people on board survived.
The Flight-data recorder shows the aircraft crossed the runway threshold at 200ft rather than at the prescribed 50 feet and much faster. As a result it didn’t touch down until 1600 metres along the runway leaving just 860 metres, which meant it overran the runway. The aircraft's right wing collided with an antenna and the aircraft dropped off the edge of a steep gorge.
Investigators say that cockpit voice recordings recorded typical breathing patterns of deep sleep from the Captain, lasting for 1h 28min, until just 21min before the accident. These recording indicated that the captain slept for at least 1h 40min.
During preparations for landing the co-pilot suggested three times that they should "go-around," which was ignored by the captain, and then erroneously confirmed the aircraft was on the correct approach following pressure by the captain to do so.
A contributing factor was that the airport radar was not working and so the landing was conducted on instruments only.
Report suggest that the captain and co-pilot had fallen out several weeks before the accident. This may be why co-pilot did not wake the captain earlier in the flight and contributed to poor communication between the pair. Also, that "prolonged sleep by the captain, particularly during the overnight circadian low period, could have led to sleep inertia and possibly impaired judgement over the approach shortly after he woke."
Saturday, April 23, 2011
Why Air Traffic Controllers Fall Asleep on the Job
There have been a number of stories in the news recently about US air traffic controllers falling asleep on the job. There has been one example of an obvious violation of rules, but overall I wonder about the systemic failures that have caused the problems.
An article in The Wall Street Journal by Langhorne Bond and Robert W Poole Jr discuss the causes.
Apparently the Federal Aviation Authority (FAA) has known about Controller fatigue for decades but "has repeatedly swept it under the rug." One of the likely problems is the shift pattern. One of the most popular is called 2-2-1: Controllers work two swing shifts, two day shifts, and one midnight shift. The second day shifts ends at 2 p.m. and the subsequent midnight shift begins at 10 p.m., just eight hours later. Such a schedule disrupts circadian rhythms, creating fatigue on the midnight shift. Controllers and their union have fought to keep 2-2-1 because it gives them a three-day weekend afterwards.
The National Transportation Safety Board (NTSB) has called for abolishing 2-2-1 and the inspector general for the Department of Transportation has called for a 10-hour minimum between shifts in general, and 16 hours after a midnight shift.
The other cause of fatigue on midnight shifts is black backgrounds on controller display screens, which require dark rooms for best visibility. But dark rooms tend to induce drowsiness, especially on a midnight shift. It is now common international practice to have light gray background screen displays that can be used in high-light environments, but in the U.S. this has been ignored.
An article in The Wall Street Journal by Langhorne Bond and Robert W Poole Jr discuss the causes.
Apparently the Federal Aviation Authority (FAA) has known about Controller fatigue for decades but "has repeatedly swept it under the rug." One of the likely problems is the shift pattern. One of the most popular is called 2-2-1: Controllers work two swing shifts, two day shifts, and one midnight shift. The second day shifts ends at 2 p.m. and the subsequent midnight shift begins at 10 p.m., just eight hours later. Such a schedule disrupts circadian rhythms, creating fatigue on the midnight shift. Controllers and their union have fought to keep 2-2-1 because it gives them a three-day weekend afterwards.
The National Transportation Safety Board (NTSB) has called for abolishing 2-2-1 and the inspector general for the Department of Transportation has called for a 10-hour minimum between shifts in general, and 16 hours after a midnight shift.
The other cause of fatigue on midnight shifts is black backgrounds on controller display screens, which require dark rooms for best visibility. But dark rooms tend to induce drowsiness, especially on a midnight shift. It is now common international practice to have light gray background screen displays that can be used in high-light environments, but in the U.S. this has been ignored.
Thursday, April 14, 2011
EI launches poster pack to encourage continuous workforce involvement in safety
Available from the Institute website
Good practice in safety across all sectors of the energy industry is of paramount importance. It is generally accepted that engagement with the workforce can lead to safer workplaces as staff become more aware of and involved in mitigating health and safety issues.
With good workforce involvement (WFI), staff, including contractors, are encouraged to take part in the decision making process about managing health and safety in the workplace, however, achieving good WFI requires planned and sustained effort. To support safety managers and leaders in their efforts to implement effective WFI programmes, the Energy Institute (EI) has developed a series of posters to encourage colleagues to contribute to safety in the workplace.
This new poster pack can be used as part of a wider WFI campaign and these resources are supported by Guidance on running a WFI campaign and using the WFI poster pack to help in proactive health and safety management. The posters tackle a number of themes, such as: What stops you from communicating safety issues? What if you are the only person in your team who sees the risk? and What ideas do you have to improve safety? The posters are designed to challenge general perceptions and provoke discussion amongst workers. To support the sharing of ideas, the series also includes space to capture comments to contribute to WFI schemes.
Good practice in safety across all sectors of the energy industry is of paramount importance. It is generally accepted that engagement with the workforce can lead to safer workplaces as staff become more aware of and involved in mitigating health and safety issues.
With good workforce involvement (WFI), staff, including contractors, are encouraged to take part in the decision making process about managing health and safety in the workplace, however, achieving good WFI requires planned and sustained effort. To support safety managers and leaders in their efforts to implement effective WFI programmes, the Energy Institute (EI) has developed a series of posters to encourage colleagues to contribute to safety in the workplace.
This new poster pack can be used as part of a wider WFI campaign and these resources are supported by Guidance on running a WFI campaign and using the WFI poster pack to help in proactive health and safety management. The posters tackle a number of themes, such as: What stops you from communicating safety issues? What if you are the only person in your team who sees the risk? and What ideas do you have to improve safety? The posters are designed to challenge general perceptions and provoke discussion amongst workers. To support the sharing of ideas, the series also includes space to capture comments to contribute to WFI schemes.
Wednesday, April 13, 2011
Introduction to Higher Reliability Organizations
Article from Fire Engineering website by Dane Carley and Craig Nelson published 11 March 2011.
The number of fatalities experienced by US fire service has not changed much in the last 20 years. "We have good, inspiring leaders who recognize the problem and provide solutions. We have good firefighters and company officers who know their jobs inside and out. They follow the rules, use solid safety practices, and train more often than ever before. Leaders, firefighters, and company officers alike are well trained, well educated, and experienced. Therefore, we believe the problem lies within the number of rules, current safety practices, and our approach to safety."
"Other industries operating in a similar environment where there are severe consequences for a single mistake do not see similar accident statistics."
The article discusses the application of the principles of Higher Reliability Organisations (HRO).
The definition of a HRO is "an organization operating in a complex, high-risk environment in which a single error has the potential for disastrous consequences, yet the organization routinely performs with a low number of errors due to various organizational characteristics intentionally engineered to prevent human error."
"An HRO accomplishes this by consciously implementing a comprehensive plan that hinges on developing a learning culture within an organization using methods such as near-miss reporting and root-cause analysis."
"An HRO recognizes that organizations are comprised of humans who, no matter how diligent they are, make mistakes. In organizations like the fire service, we must first accept that we all make mistakes, no matter how smart, educated, or talented we are. An HRO builds systems on five basic principles to prevent a mistake, compensate when a mistake does occur, and then learn from the mistake to prevent it from occurring again. Weick and Sutcliffe (2007) list the principles of an HRO as:
Preoccupation with failure
Reluctance to simplify
Sensitivity to operations
Commitment to resilience
Deference to expertise"
The number of fatalities experienced by US fire service has not changed much in the last 20 years. "We have good, inspiring leaders who recognize the problem and provide solutions. We have good firefighters and company officers who know their jobs inside and out. They follow the rules, use solid safety practices, and train more often than ever before. Leaders, firefighters, and company officers alike are well trained, well educated, and experienced. Therefore, we believe the problem lies within the number of rules, current safety practices, and our approach to safety."
"Other industries operating in a similar environment where there are severe consequences for a single mistake do not see similar accident statistics."
The article discusses the application of the principles of Higher Reliability Organisations (HRO).
The definition of a HRO is "an organization operating in a complex, high-risk environment in which a single error has the potential for disastrous consequences, yet the organization routinely performs with a low number of errors due to various organizational characteristics intentionally engineered to prevent human error."
"An HRO accomplishes this by consciously implementing a comprehensive plan that hinges on developing a learning culture within an organization using methods such as near-miss reporting and root-cause analysis."
"An HRO recognizes that organizations are comprised of humans who, no matter how diligent they are, make mistakes. In organizations like the fire service, we must first accept that we all make mistakes, no matter how smart, educated, or talented we are. An HRO builds systems on five basic principles to prevent a mistake, compensate when a mistake does occur, and then learn from the mistake to prevent it from occurring again. Weick and Sutcliffe (2007) list the principles of an HRO as:
Preoccupation with failure
Reluctance to simplify
Sensitivity to operations
Commitment to resilience
Deference to expertise"
US Fire service
I happened to come across the Fire Engineering website. It seems to contains some very valuable information.
I found this a paper Learning from Firefighter Fatalities very interesting. It is a discussion dating from 2004. I think it will be interesting to anyone working in a hazardous industry. Firefighters have to deal with emergencies far more often than most organisations. They have plenty of experience of what can go wrong.
The site includes a continually updating section notifying of Line of Duty Deaths. A very sobering read.
Firefighters drills is another section that looks interesting. You don't need to be a full time firefighter to be involved in emergency response.
I found this a paper Learning from Firefighter Fatalities very interesting. It is a discussion dating from 2004. I think it will be interesting to anyone working in a hazardous industry. Firefighters have to deal with emergencies far more often than most organisations. They have plenty of experience of what can go wrong.
The site includes a continually updating section notifying of Line of Duty Deaths. A very sobering read.
Firefighters drills is another section that looks interesting. You don't need to be a full time firefighter to be involved in emergency response.
Friday, April 01, 2011
Asda sold 12.9p petrol by mistake
BBC Website 1 April 2011
Drivers paid just 12.9p a litre for petrol after staff put a decimal point in the wrong place.
About 50 motorists stocked up on unleaded fuel at the petrol station in Rooley Lane, Bradford, West Yorkshire.
Drivers queued up to use the automatic card-payment pumps for about two hours until the mistake was spotted.
Some motorists also filled up petrol cans with the bargain fuel after word spread around the city.
Drivers paid just 12.9p a litre for petrol after staff put a decimal point in the wrong place.
About 50 motorists stocked up on unleaded fuel at the petrol station in Rooley Lane, Bradford, West Yorkshire.
Drivers queued up to use the automatic card-payment pumps for about two hours until the mistake was spotted.
Some motorists also filled up petrol cans with the bargain fuel after word spread around the city.
Wednesday, March 16, 2011
Three Mile Island
This one of the classic human error examples. With the problems in Japan with the Fukushima Daiichi following the earth quake and tsunami, the BBC has given a good summary of what happened at 4am on Wednesday 28 March, 1979.
A relatively routine malfunction in a non-nuclear system caused a relief valve to open, releasing coolant from the core. The valve should have closed after a moment, but it didn't, and a large volume of coolant escaped.
There was no straightforward way for the plant's operators to know that the valve was the problem. No instrument on their control panel indicated whether it was open or closed.
Operators knew something was going wrong, though - alarms sounded and lights were flashing.
They mistakenly diagnosed the issue as being too much coolant in the pressuriser and shut off the emergency core cooling system, the first in a series of missteps that escalated the crisis.
"In not knowing what was going wrong and taking exactly the wrong action, they exacerbated the problem by orders of magnitude," says J Samuel Walker, a historian who worked for many years for the Nuclear Regulatory Commission (NRC), the US atomic agency and nuclear watchdog.
Operators worked furiously for days to minimize the meltdown.
It wasn't until 1985, when sophisticated cameras were sent into the core, that authorities understood the enormous extent of the meltdown.
The TMI disaster took over 12 years to clean up, at a cost of about $973m (£605m).
Fortunately, little radiation was released, and multiple studies have shown no serious health impacts.
There was no documented increase in cancers. Links between TMI and problems with livestock in the area, including deaths and reproductive issues, have not been proven.
A relatively routine malfunction in a non-nuclear system caused a relief valve to open, releasing coolant from the core. The valve should have closed after a moment, but it didn't, and a large volume of coolant escaped.
There was no straightforward way for the plant's operators to know that the valve was the problem. No instrument on their control panel indicated whether it was open or closed.
Operators knew something was going wrong, though - alarms sounded and lights were flashing.
They mistakenly diagnosed the issue as being too much coolant in the pressuriser and shut off the emergency core cooling system, the first in a series of missteps that escalated the crisis.
"In not knowing what was going wrong and taking exactly the wrong action, they exacerbated the problem by orders of magnitude," says J Samuel Walker, a historian who worked for many years for the Nuclear Regulatory Commission (NRC), the US atomic agency and nuclear watchdog.
Operators worked furiously for days to minimize the meltdown.
It wasn't until 1985, when sophisticated cameras were sent into the core, that authorities understood the enormous extent of the meltdown.
The TMI disaster took over 12 years to clean up, at a cost of about $973m (£605m).
Fortunately, little radiation was released, and multiple studies have shown no serious health impacts.
There was no documented increase in cancers. Links between TMI and problems with livestock in the area, including deaths and reproductive issues, have not been proven.
Monday, March 14, 2011
Wales earned rub of the green
This is South Wales 14 March 2011
Referring to the Six Nations rugby match between Wales and Ireland played in Cardiff on 12 March.
Wales were awarded a try following a quick throw in that used a ball different to the one that went out of play.
"A quick throw in is not permitted if another person has touched the ball apart from the player throwing it in and an opponent who carried it into touch."
Referee Jonathan Kaplan consulted Allan before awarding the score, asking him: "Was it the correct ball?"
Allan replied in the affirmative, despite the fresh ball having been thrown to Rees by a ball-boy, meaning there were not one but two breaches of the IRB's rule.
There are bound to be questions asked about how an official on the international circuit can make such a blunder.
The more charitable will accept it as human error.
But some will want to see Allan punished, perhaps confined to Scottish domestic rugby for ever and a day — Hawick v Melrose, anyone?
Referring to the Six Nations rugby match between Wales and Ireland played in Cardiff on 12 March.
Wales were awarded a try following a quick throw in that used a ball different to the one that went out of play.
"A quick throw in is not permitted if another person has touched the ball apart from the player throwing it in and an opponent who carried it into touch."
Referee Jonathan Kaplan consulted Allan before awarding the score, asking him: "Was it the correct ball?"
Allan replied in the affirmative, despite the fresh ball having been thrown to Rees by a ball-boy, meaning there were not one but two breaches of the IRB's rule.
There are bound to be questions asked about how an official on the international circuit can make such a blunder.
The more charitable will accept it as human error.
But some will want to see Allan punished, perhaps confined to Scottish domestic rugby for ever and a day — Hawick v Melrose, anyone?
Friday, March 11, 2011
Bayer CropScience Pesticide Waste Tank Explosion
Details of the investigation carried out by US Chemical Safety Board (CSB)of the Chemical runaway reaction leading to pressure vessel explosion on 28 August 2008 that kills two and injured eight. Available include:
* Final report
* Video on CSB website and on YouTube
The incident occurred during the restart of the methomyl unit after an extended outage to upgrade the control system and replace the original residue treater vessel. The Chemical Safety Board (CSB) investigation highlighted the following issues:
* Deviation from the written start-up procedures,
* Bypassing critical safety devices intended to prevent such a condition.
* Inadequate pre-startup safety review;
* Inadequate operator training on the newly installed control system;
* Unevaluated temporary changes,
* Malfunctioning or missing equipment, misaligned valves, and bypassed critical safety devices;
* Insufficient technical expertise available in the control room during the restart.
* Poor communications during the emergency between the Bayer CropScience incident command and the local emergency response agency confused emergency response organizations and delayed public announcements on actions that should be taken to minimize exposure risk
Pre-Startup Activities
Unlike the normal methomyl restart after a routine shutdown, the August restart involved operations personnel, engineering staff, and contractors working around the clock to complete the control system upgrade and residue treater replacement. Work included finalizing the software upgrades, modifying the work station, calibrating instruments, and checking critical components. Board operators were provided time at the methomyl work station so that they could familiarize themselves with the new control functions, equipment and instrument displays, alarms, and other system features. Other personnel were completing the residue treater replacement, reinstalling piping and components, and reconnecting the control and instrument wiring. These activities progressed in parallel with the ongoing Larvin unit operation.
The methomyl control system upgrade required a revision to the SOP to incorporate the changes needed to operate the methomyl unit with the new Siemens system, and to reformat the SOP to a computerized document. However, at the time of the incident the SOP revision remained incomplete; the operators were using an unapproved SOP that did not contain the new control system operating details.
Solvent Flush and Equipment Conditioning
Many of the subsystems in the methomyl unit required a solvent flush and nitrogen gas purge to clean and dry the systems before startup. These activities were critical to safely start the residue treater system as the feed, recirculation, and vent piping had been disconnected and a new pressure vessel had been installed. The solvent-only run was also needed to verify instrument calibrations, proper equipment operating sequences, and other operating parameters in the new DCS.
The staff flushed the process equipment with solvent to remove contaminants and water that might have gotten into the system during the outage. However, contrary to the SOP 25 the staff did not perform the residue treater solvent run.26 Operators reported that solvent flow restrictions upstream impeded completion of instrument calibrations because the proper adjustments could not be made at low flow rates. Even had the staff not needed to verify the control system function and operability, the solvent run was required to pre-fill the residue treater to the minimum operating level and to heat the liquid to the minimum operating temperature before adding the methomyl containing flasher bottoms feed.
2.2 Unit Restart
Although the operations staff acknowledged that management had not prescribed a specific deadline for resuming methomyl production, onsite stockpiles of methomyl necessary to make Larvin were dwindling. Unit personnel recognized the important role of methomyl in the business performance of the facility, and a recent increase in worldwide demand for Larvin created a significant, sustained production schedule. Methomyl-Larvin operating staff told CSB investigators that they looked
forward to resuming methomyl production and a return to the normal daily work routine after the long unit shutdown.
Operator logs documented the plan to start the MSAO (a.k.a. Oxime) unit Monday morning, August 25. Methomyl synthesis needed to begin shortly thereafter. However, critical startup activities were not completed, and the staff struggled with many problems as they attempted to bring each subsystem on line. To complicate the startup problems, process computer system engineers had not verified the
functionality of all process controls and instruments in the new control system.
Control System Upgrade
The introduction of the Siemens PCS7 control system significantly changed the interactions between the board operators and the DCS interface. The Siemens control system contained features intended to minimize human error such as graphical display screens that simulated process flow and automated icons to display process variables. But the increased complexities of the new operating system challenged operators as they worked to familiarize themselves with the system and units of measurement for process variables differed from those in the previously used Honeywell system.
Human interactions with computers are physical, visual, and cognitive. New visual displays and modified command entry methods, such as changing from a keyboard to a mouse, can influence the usability of the human-computer interface and impair human performance when training is inadequate. Operators told CSB investigators they were concerned with the slower command response times in the Siemens system and they talked about the methomyl process control issues they would face during the restart, which was much more difficult to control than the Larvin process. Board operators also told CSB investigators that the detailed process equipment displays in the DCS were difficult to navigate. Routine activities like starting a reaction or troubleshooting alarms would require operators to move between multiple screens to complete a task, which degraded operator awareness and response times.
The old system display and command entry was basically a spreadsheet, or line-item display. The new system used a graphical user interface (GUI) that displayed an illustrative likeness of the process and its various components (Figure 18). The board operator selected the device that needed to be changed. This made data entry clearer, but much slower. In the old system, board operators could change multiple process variables simultaneously, but they could select and change only one variable at a time in the Siemens system.
The new control system also changed how board operators monitored multiple pieces of equipment. The methomyl board operators’ station had five display screens available to monitor the methomyl processes and one display screen dedicated to process alarms. However, operating some methomyl equipment required the operators to use at least three of the five display screens. To simplify the operation, they asked the Siemens project engineers to add equipment overview screens to display multiple pieces of equipment. The board operators believed that the overview screens would provide more effective control of the unit; however, the screens were not available for the August 2008 startup.
* Final report
* Video on CSB website and on YouTube
The incident occurred during the restart of the methomyl unit after an extended outage to upgrade the control system and replace the original residue treater vessel. The Chemical Safety Board (CSB) investigation highlighted the following issues:
* Deviation from the written start-up procedures,
* Bypassing critical safety devices intended to prevent such a condition.
* Inadequate pre-startup safety review;
* Inadequate operator training on the newly installed control system;
* Unevaluated temporary changes,
* Malfunctioning or missing equipment, misaligned valves, and bypassed critical safety devices;
* Insufficient technical expertise available in the control room during the restart.
* Poor communications during the emergency between the Bayer CropScience incident command and the local emergency response agency confused emergency response organizations and delayed public announcements on actions that should be taken to minimize exposure risk
Pre-Startup Activities
Unlike the normal methomyl restart after a routine shutdown, the August restart involved operations personnel, engineering staff, and contractors working around the clock to complete the control system upgrade and residue treater replacement. Work included finalizing the software upgrades, modifying the work station, calibrating instruments, and checking critical components. Board operators were provided time at the methomyl work station so that they could familiarize themselves with the new control functions, equipment and instrument displays, alarms, and other system features. Other personnel were completing the residue treater replacement, reinstalling piping and components, and reconnecting the control and instrument wiring. These activities progressed in parallel with the ongoing Larvin unit operation.
The methomyl control system upgrade required a revision to the SOP to incorporate the changes needed to operate the methomyl unit with the new Siemens system, and to reformat the SOP to a computerized document. However, at the time of the incident the SOP revision remained incomplete; the operators were using an unapproved SOP that did not contain the new control system operating details.
Solvent Flush and Equipment Conditioning
Many of the subsystems in the methomyl unit required a solvent flush and nitrogen gas purge to clean and dry the systems before startup. These activities were critical to safely start the residue treater system as the feed, recirculation, and vent piping had been disconnected and a new pressure vessel had been installed. The solvent-only run was also needed to verify instrument calibrations, proper equipment operating sequences, and other operating parameters in the new DCS.
The staff flushed the process equipment with solvent to remove contaminants and water that might have gotten into the system during the outage. However, contrary to the SOP 25 the staff did not perform the residue treater solvent run.26 Operators reported that solvent flow restrictions upstream impeded completion of instrument calibrations because the proper adjustments could not be made at low flow rates. Even had the staff not needed to verify the control system function and operability, the solvent run was required to pre-fill the residue treater to the minimum operating level and to heat the liquid to the minimum operating temperature before adding the methomyl containing flasher bottoms feed.
2.2 Unit Restart
Although the operations staff acknowledged that management had not prescribed a specific deadline for resuming methomyl production, onsite stockpiles of methomyl necessary to make Larvin were dwindling. Unit personnel recognized the important role of methomyl in the business performance of the facility, and a recent increase in worldwide demand for Larvin created a significant, sustained production schedule. Methomyl-Larvin operating staff told CSB investigators that they looked
forward to resuming methomyl production and a return to the normal daily work routine after the long unit shutdown.
Operator logs documented the plan to start the MSAO (a.k.a. Oxime) unit Monday morning, August 25. Methomyl synthesis needed to begin shortly thereafter. However, critical startup activities were not completed, and the staff struggled with many problems as they attempted to bring each subsystem on line. To complicate the startup problems, process computer system engineers had not verified the
functionality of all process controls and instruments in the new control system.
Control System Upgrade
The introduction of the Siemens PCS7 control system significantly changed the interactions between the board operators and the DCS interface. The Siemens control system contained features intended to minimize human error such as graphical display screens that simulated process flow and automated icons to display process variables. But the increased complexities of the new operating system challenged operators as they worked to familiarize themselves with the system and units of measurement for process variables differed from those in the previously used Honeywell system.
Human interactions with computers are physical, visual, and cognitive. New visual displays and modified command entry methods, such as changing from a keyboard to a mouse, can influence the usability of the human-computer interface and impair human performance when training is inadequate. Operators told CSB investigators they were concerned with the slower command response times in the Siemens system and they talked about the methomyl process control issues they would face during the restart, which was much more difficult to control than the Larvin process. Board operators also told CSB investigators that the detailed process equipment displays in the DCS were difficult to navigate. Routine activities like starting a reaction or troubleshooting alarms would require operators to move between multiple screens to complete a task, which degraded operator awareness and response times.
The old system display and command entry was basically a spreadsheet, or line-item display. The new system used a graphical user interface (GUI) that displayed an illustrative likeness of the process and its various components (Figure 18). The board operator selected the device that needed to be changed. This made data entry clearer, but much slower. In the old system, board operators could change multiple process variables simultaneously, but they could select and change only one variable at a time in the Siemens system.
The new control system also changed how board operators monitored multiple pieces of equipment. The methomyl board operators’ station had five display screens available to monitor the methomyl processes and one display screen dedicated to process alarms. However, operating some methomyl equipment required the operators to use at least three of the five display screens. To simplify the operation, they asked the Siemens project engineers to add equipment overview screens to display multiple pieces of equipment. The board operators believed that the overview screens would provide more effective control of the unit; however, the screens were not available for the August 2008 startup.
Deadly Practices
Video from US Chemical Safety Board (CSB). Also available on YouTube.
It shows several accidents where vented natural gas has caused fires and explosions. They include the Kleen Energy power plant and a Hilton Hotel.
It shows several accidents where vented natural gas has caused fires and explosions. They include the Kleen Energy power plant and a Hilton Hotel.
Thursday, March 10, 2011
What organisations can learn from bees
British Airways in-flight 'Business:life' magazine January 2011
Management consultant Michael O'Malley lists five ways that the way a bee hive works can teach us lessons for organisational success:
1. Pursue common goals. Bees have reproductive success and survival as their overarching goals and deal with instances where individuals attempt to pursue their own goals that are against the interests of the group, such as when worker bees lay eggs when only the queen has that right.
2. Protect the future. Bees proffer consistent and gradual gain and avoid boom and bust. Even if they find an exceptionally good patch of flowers, they don't all rush to harvest from that location. Instead, they always have scout bees looking for new opportunities, and when times get hard they invest more resources in scouting.
3. Distribute authority. Although the queen has a prominent role, this is mainly to keep the colony calm. Most decisions are made by the workers themselves, with the most important being made by those closest to the action that have access to the best information.
4. Safeguard against catastrophic loss. Bees achieve this in three ways. First, they maintain diversity (genetically), which means they do not all act the same way and so the colony is more able to deal with all situations it encounters. Second, they work flexibly so that different bees can step in to perform essential functions if those originally in that role are lost. Third, bees know they make mistakes but they choose to make errors that are least likely to have major consequences.
5. Avoid self-inflicted death. Bees need to keen the colony clean, and so expel those that may jeopardise this (i.e. have a contagious infection). This is like writing a reference for people who do not fit into an organisation, rather than keeping them to inflict damage.
Bees are a good example of an environmentally friendly organisation. They perform an essential role through pollination. They never take all the pollen or nectar from a flower, because that increases regeneration time.
Management consultant Michael O'Malley lists five ways that the way a bee hive works can teach us lessons for organisational success:
1. Pursue common goals. Bees have reproductive success and survival as their overarching goals and deal with instances where individuals attempt to pursue their own goals that are against the interests of the group, such as when worker bees lay eggs when only the queen has that right.
2. Protect the future. Bees proffer consistent and gradual gain and avoid boom and bust. Even if they find an exceptionally good patch of flowers, they don't all rush to harvest from that location. Instead, they always have scout bees looking for new opportunities, and when times get hard they invest more resources in scouting.
3. Distribute authority. Although the queen has a prominent role, this is mainly to keep the colony calm. Most decisions are made by the workers themselves, with the most important being made by those closest to the action that have access to the best information.
4. Safeguard against catastrophic loss. Bees achieve this in three ways. First, they maintain diversity (genetically), which means they do not all act the same way and so the colony is more able to deal with all situations it encounters. Second, they work flexibly so that different bees can step in to perform essential functions if those originally in that role are lost. Third, bees know they make mistakes but they choose to make errors that are least likely to have major consequences.
5. Avoid self-inflicted death. Bees need to keen the colony clean, and so expel those that may jeopardise this (i.e. have a contagious infection). This is like writing a reference for people who do not fit into an organisation, rather than keeping them to inflict damage.
Bees are a good example of an environmentally friendly organisation. They perform an essential role through pollination. They never take all the pollen or nectar from a flower, because that increases regeneration time.
Friday, March 04, 2011
Buncefield: Why did it happen?
Report published February 2011 and available at the HSE website.
Report sub heading "The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005"
On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol. The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. Eventually large quantities of petrol overflowed from the top of the tank. A vapour cloud formed which ignited causing a massive explosion and a fire that lasted five days.
The gauge had stuck intermittently after the tank had been serviced in August 2005. However, neither site management nor the contractors who maintained the systems responded effectively to its obvious unreliability. The IHLS needed a padlock to retain its check lever in a working position. However, the switch supplier did not communicate this critical point to the installer and maintenance contractor or the site operator. Because of this lack of understanding, the padlock was not fitted.
Having failed to contain the petrol, there was reliance on a bund retaining wall around the tank (secondary containment) and a system of drains and catchment areas (tertiary containment) to ensure that liquids could not be released to the environment. Both forms of containment failed. Pollutants from fuel and firefighting liquids leaked from the bund, flowed off site and entered the groundwater. These containment systems were inadequately designed and maintained.
Failures of design and maintenance in both overfill protection systems and liquid containment systems were the technical causes of the initial explosion and the seepage of pollutants to the environment in its aftermath. However, underlying these immediate failings lay root causes based in broader management failings:
Management systems in place at HOSL relating to tank filling were both deficient and not properly followed, despite the fact that the systems were independently audited.
Pressures on staff had been increasing before the incident. The site was fed by three pipelines, two of which control room staff had little control over in terms of flow rates and timing of receipt. This meant that staff did not have sufficient information easily available to them to manage precisely the storage of incoming fuel.
Throughput had increased at the site. This put more pressure on site management and staff and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff was made worse by a lack of engineering support from Head Office.
Cumulatively, these pressures created a culture where keeping the process operating was the primary focus and process safety did not get the attention, resources or priority that it required.
This report does not identify any new learning about major accident prevention. Rather it serves to reinforce some important process safety management principles that have been known for some time:
There should be a clear understanding of major accident risks and the safety critical equipment and systems designed to control them.
This understanding should exist within organisations from the senior management down to the shop floor, and it needs to exist between all organisations involved in supplying, installing, maintaining and operating these controls.
There should be systems and a culture in place to detect signals of failure in safety critical equipment and to respond to them quickly and effectively.
In this case, there were clear signs that the equipment was not fit for purpose but no one questioned why, or what should be done about it other than ensure a series of temporary fixes.
Time and resources for process safety should be made available.
The pressures on staff and managers should be understood and managed so that they have the capacity to apply procedures and systems essential for safe operation.
Once all the above are in place:
There should be effective auditing systems in place which test the quality of management systems and ensure that these systems are actually being used on the ground and are effective.
At the core of managing a major hazard business should be clear and positive process safety leadership with board-level involvement and competence to ensure that major hazard risks are being properly managed.
Report sub heading "The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005"
On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol. The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. Eventually large quantities of petrol overflowed from the top of the tank. A vapour cloud formed which ignited causing a massive explosion and a fire that lasted five days.
The gauge had stuck intermittently after the tank had been serviced in August 2005. However, neither site management nor the contractors who maintained the systems responded effectively to its obvious unreliability. The IHLS needed a padlock to retain its check lever in a working position. However, the switch supplier did not communicate this critical point to the installer and maintenance contractor or the site operator. Because of this lack of understanding, the padlock was not fitted.
Having failed to contain the petrol, there was reliance on a bund retaining wall around the tank (secondary containment) and a system of drains and catchment areas (tertiary containment) to ensure that liquids could not be released to the environment. Both forms of containment failed. Pollutants from fuel and firefighting liquids leaked from the bund, flowed off site and entered the groundwater. These containment systems were inadequately designed and maintained.
Failures of design and maintenance in both overfill protection systems and liquid containment systems were the technical causes of the initial explosion and the seepage of pollutants to the environment in its aftermath. However, underlying these immediate failings lay root causes based in broader management failings:
Management systems in place at HOSL relating to tank filling were both deficient and not properly followed, despite the fact that the systems were independently audited.
Pressures on staff had been increasing before the incident. The site was fed by three pipelines, two of which control room staff had little control over in terms of flow rates and timing of receipt. This meant that staff did not have sufficient information easily available to them to manage precisely the storage of incoming fuel.
Throughput had increased at the site. This put more pressure on site management and staff and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff was made worse by a lack of engineering support from Head Office.
Cumulatively, these pressures created a culture where keeping the process operating was the primary focus and process safety did not get the attention, resources or priority that it required.
This report does not identify any new learning about major accident prevention. Rather it serves to reinforce some important process safety management principles that have been known for some time:
There should be a clear understanding of major accident risks and the safety critical equipment and systems designed to control them.
This understanding should exist within organisations from the senior management down to the shop floor, and it needs to exist between all organisations involved in supplying, installing, maintaining and operating these controls.
There should be systems and a culture in place to detect signals of failure in safety critical equipment and to respond to them quickly and effectively.
In this case, there were clear signs that the equipment was not fit for purpose but no one questioned why, or what should be done about it other than ensure a series of temporary fixes.
Time and resources for process safety should be made available.
The pressures on staff and managers should be understood and managed so that they have the capacity to apply procedures and systems essential for safe operation.
Once all the above are in place:
There should be effective auditing systems in place which test the quality of management systems and ensure that these systems are actually being used on the ground and are effective.
At the core of managing a major hazard business should be clear and positive process safety leadership with board-level involvement and competence to ensure that major hazard risks are being properly managed.
Why designers should pay more attention to ergonomic issues
Article in Engineer Live, March 2011. Interview with Gary Davis from Davis Associates
Gary reports a number of reasons why 'forward thinking' companies are taking ergonomics seriously. They include:
* Changing demographic; by the year 2020 half the adults in the UK will be aged 50 or over and the number of older people in the world will double to 1.2 billion by 2028. Inclusive design, in which products and services are usable by the widest possible range of people, therefore provides access to an expanding market.
* Usability is now considered to be a minimum requirement and the requirement is to make a product more pleasurable to use and to give it the 'wow!' factor. Ergonomics is becoming recognised as something that can create a commercial advantage
* Pressure from legislators. For example, ISO11064 Ergonomic design of control centres, Equal Treatment Framework Directive 2000/78/EC) and new EU Machinery Directive 2006/42/EC places a much greater emphasis on ergonomics than its predecessor).
* Ergonomics is a good way to protect a brand or strengthen it. If your products gain a reputation for being user-friendly, this can become important in markets where product differentiation is otherwise difficult."
* Conversely, the relatively new phenomenon of websites providing consumers with the opportunity to review products can damage brands if products are found to be unsatisfactory.
* If you consider ergonomics from the outset, you are less likely to have to make last-minute design changes
* If products are intuitive and comfortable to use, this reduces the need to provide after-sales support, plus it helps to minimise the number of product returns and warranty claims."
* Applying ergonomics to operator workstations can improve safety, reduce the opportunities for errors to be made, and raise productivity.
Quantifying the benefits of improved ergonomics can be difficult, but one area where this is done routinely is in website design, particularly for sales-orientated sites. Indeed, a specialist industry has evolved to improve website usability - which can be translated very rapidly into increased sales and, ultimately, profits that far outweigh the costs of the usability consultancy.
Elsewhere, of course, investing in ergonomics can reap rewards in the early stages of a project and at other points too - such as when alternative concepts are being assessed, and when pre-production units are available for user trials. Almost any level of ergonomics input can benefit a design, resulting in improved consumer satisfaction, appeal to a wider range of users, enhanced safety and so on.
Gary reports a number of reasons why 'forward thinking' companies are taking ergonomics seriously. They include:
* Changing demographic; by the year 2020 half the adults in the UK will be aged 50 or over and the number of older people in the world will double to 1.2 billion by 2028. Inclusive design, in which products and services are usable by the widest possible range of people, therefore provides access to an expanding market.
* Usability is now considered to be a minimum requirement and the requirement is to make a product more pleasurable to use and to give it the 'wow!' factor. Ergonomics is becoming recognised as something that can create a commercial advantage
* Pressure from legislators. For example, ISO11064 Ergonomic design of control centres, Equal Treatment Framework Directive 2000/78/EC) and new EU Machinery Directive 2006/42/EC places a much greater emphasis on ergonomics than its predecessor).
* Ergonomics is a good way to protect a brand or strengthen it. If your products gain a reputation for being user-friendly, this can become important in markets where product differentiation is otherwise difficult."
* Conversely, the relatively new phenomenon of websites providing consumers with the opportunity to review products can damage brands if products are found to be unsatisfactory.
* If you consider ergonomics from the outset, you are less likely to have to make last-minute design changes
* If products are intuitive and comfortable to use, this reduces the need to provide after-sales support, plus it helps to minimise the number of product returns and warranty claims."
* Applying ergonomics to operator workstations can improve safety, reduce the opportunities for errors to be made, and raise productivity.
Quantifying the benefits of improved ergonomics can be difficult, but one area where this is done routinely is in website design, particularly for sales-orientated sites. Indeed, a specialist industry has evolved to improve website usability - which can be translated very rapidly into increased sales and, ultimately, profits that far outweigh the costs of the usability consultancy.
Elsewhere, of course, investing in ergonomics can reap rewards in the early stages of a project and at other points too - such as when alternative concepts are being assessed, and when pre-production units are available for user trials. Almost any level of ergonomics input can benefit a design, resulting in improved consumer satisfaction, appeal to a wider range of users, enhanced safety and so on.
Thursday, March 03, 2011
July 7/7 - Management jargon
Interesting comments made by Lady Justice Hallett (the coroner), reported on the BBC website.
"A succession of senior figures from across the capital's emergency services have appeared before Lady Justice Hallett - but on the final day of the inquests, she told them to use plain English, rather than refer to things like the "Conference Demountable Unit from the Management Resource Unit".
"Management jargon is taking over organisations," said Lady Justice Hallett. "When it comes to something like a major incident, people do not understand what the other person is.
"All you senior people from these organisations are allowing yourselves to be taken over by management jargon... You people at the top need to say 'We have to communicate with other people and we communicate with plain English'."
"I am sorry if that sounded like a rant but everybody who has been here for the last few months will know I have been building up to it."
"A succession of senior figures from across the capital's emergency services have appeared before Lady Justice Hallett - but on the final day of the inquests, she told them to use plain English, rather than refer to things like the "Conference Demountable Unit from the Management Resource Unit".
"Management jargon is taking over organisations," said Lady Justice Hallett. "When it comes to something like a major incident, people do not understand what the other person is.
"All you senior people from these organisations are allowing yourselves to be taken over by management jargon... You people at the top need to say 'We have to communicate with other people and we communicate with plain English'."
"I am sorry if that sounded like a rant but everybody who has been here for the last few months will know I have been building up to it."
Monday, February 28, 2011
7/7 inquests: 'Failings' hindered ambulance controllers
Ambulance controllers trying to respond to the 7/7 attacks worked in chaos amid a series of shortcomings, the inquests into the attacks have heard.
They include:
* Only one woman logged all the emergency calls and vital information was written on scraps of paper, it was revealed.
* Ambulance Service logger said: "I am not a trained typist, I use two fingers and a thumb."
* The employee in charge of updating the control room whiteboard could only reach halfway up it.
* Two of the people designated "crucial roles" at the start of the incident were not trained in the procedures for the so-called Gold Command - in overall control of the emergency.
* Staff transferring from their normal control room positions to the Gold disaster control room caused a delay because they had not logged off properly. That meant they were then unable to log on to the new system as calls from the four terror sites built up, causing a backlog.
* There were communications issues throughout. Radio channels were blocked and no feedback was coming in from ambulance bosses on the ground.
* There was so much information coming in that control room staff were unable to prioritise it effectively.
* Failed radio and mobile phone networks meant there were serious delays in dispatching paramedics to bomb sites.
They include:
* Only one woman logged all the emergency calls and vital information was written on scraps of paper, it was revealed.
* Ambulance Service logger said: "I am not a trained typist, I use two fingers and a thumb."
* The employee in charge of updating the control room whiteboard could only reach halfway up it.
* Two of the people designated "crucial roles" at the start of the incident were not trained in the procedures for the so-called Gold Command - in overall control of the emergency.
* Staff transferring from their normal control room positions to the Gold disaster control room caused a delay because they had not logged off properly. That meant they were then unable to log on to the new system as calls from the four terror sites built up, causing a backlog.
* There were communications issues throughout. Radio channels were blocked and no feedback was coming in from ambulance bosses on the ground.
* There was so much information coming in that control room staff were unable to prioritise it effectively.
* Failed radio and mobile phone networks meant there were serious delays in dispatching paramedics to bomb sites.
Friday, February 25, 2011
No easy solutions for alarm fatigue
Article at Boston.com by Liz Kowalczyk on 14 February 2011
77 year old Madeline Warner died at UMass Memorial Medical Center in Worcester USA died after nurses failed to respond to an alarm that sounded for about 75 minutes, signalling that her heart monitor’s battery needed to be replaced, state investigators found.
The article explains the problems in hospitals with large numbers of alarms that personnel are required to respond to. The whole industry is finding it difficult to come up with a solution. Options include:
1. Improving monitor technology, to sharply decrease the number of false alarms, which some studies have shown exceed 85 percent. New machines would simultaneously sense multiple measures of a patient’s health to more accurately gauge whether a patient is really in crisis.
2. Hiring more nurses, and assigning some to do nothing but watch monitors for alarms.
3. Strengthening voluntary industry standards or federal rules for monitor design and use, such as requirements for how loud alarms should be, or how long monitors should delay sounding an alarm to ensure an apparent problem is real and reduce false alarms.
4. Implement new guidelines for doctors on when to order cardiac monitoring for patients, and how often they must recheck their orders. When technology is readily available doctors end up ordering it for patients who might not benefit. But persuading doctors to put significantly fewer patients on monitors will be a huge challenge, because monitors can be an important tool for alerting staff to problems.
The hospital has already made changes to reduce the likelihood of alarms being missed. Low-battery warnings now appear on the pager or cellphone of the patient’s nurse. If he or she does not respond within a minute, a page goes to all nurses on the unit — as do alarms for potential life-threatening changes in patients. Also, the hospital has replaced cheap $1 leads for the wires that run from a patient’s chest to the monitor with $14 leads that rarely fall off and significantly reducing “leads-off’’ alarms.
GE Healthcare, a monitor maker, is testing similar technology for intensive care units. The company said the new software significantly reduces the number of false heart rate alarms because it uses information from a variety of physiological signals to evaluate patients, rather than just cardiac information. At one hospital, “the technology resulted in an 89 percent reduction in false asystole alarms’’ (asystole refers to a state of no cardiac activity), compared with a traditional cardiac monitor, the company said in a written statement. But this approach is probably only likely to work in intensive care.
77 year old Madeline Warner died at UMass Memorial Medical Center in Worcester USA died after nurses failed to respond to an alarm that sounded for about 75 minutes, signalling that her heart monitor’s battery needed to be replaced, state investigators found.
The article explains the problems in hospitals with large numbers of alarms that personnel are required to respond to. The whole industry is finding it difficult to come up with a solution. Options include:
1. Improving monitor technology, to sharply decrease the number of false alarms, which some studies have shown exceed 85 percent. New machines would simultaneously sense multiple measures of a patient’s health to more accurately gauge whether a patient is really in crisis.
2. Hiring more nurses, and assigning some to do nothing but watch monitors for alarms.
3. Strengthening voluntary industry standards or federal rules for monitor design and use, such as requirements for how loud alarms should be, or how long monitors should delay sounding an alarm to ensure an apparent problem is real and reduce false alarms.
4. Implement new guidelines for doctors on when to order cardiac monitoring for patients, and how often they must recheck their orders. When technology is readily available doctors end up ordering it for patients who might not benefit. But persuading doctors to put significantly fewer patients on monitors will be a huge challenge, because monitors can be an important tool for alerting staff to problems.
The hospital has already made changes to reduce the likelihood of alarms being missed. Low-battery warnings now appear on the pager or cellphone of the patient’s nurse. If he or she does not respond within a minute, a page goes to all nurses on the unit — as do alarms for potential life-threatening changes in patients. Also, the hospital has replaced cheap $1 leads for the wires that run from a patient’s chest to the monitor with $14 leads that rarely fall off and significantly reducing “leads-off’’ alarms.
GE Healthcare, a monitor maker, is testing similar technology for intensive care units. The company said the new software significantly reduces the number of false heart rate alarms because it uses information from a variety of physiological signals to evaluate patients, rather than just cardiac information. At one hospital, “the technology resulted in an 89 percent reduction in false asystole alarms’’ (asystole refers to a state of no cardiac activity), compared with a traditional cardiac monitor, the company said in a written statement. But this approach is probably only likely to work in intensive care.
Mother dies after nurse makes error administering drug
Article from the Daily Mail 23 February 2011
In true Daily Mail style the story is hyped under the title "Mother-of-four dies after blundering nurse administers TEN times drug overdose"
80 year old Arsula Samson died on 14 March 2010 at Good Hope Hospital, Birmingham after she was given an overdose of deadly potassium chloride.
According to the inquest staff nurse Lisa Sparrow wrongly administered 50ml of the drug over half an hour instead of over five hours, the inquest heard.
Instead of pressing the 10ml per hour button, the nurse admitted tapping in 100ml per hour on the drug infusion pump.
Staff nurse Sparrow signed out the medication from the controlled drug stock cupboard with staff nurse Susan Smith, as two people were supposed to administer and check the drug together to avoid any errors under hospital policy.
But nurse Smith left nurse Sparrow to give the drug on her own when the error happened. The coroner said that nurse Sparrow's gross failure resulted in the overdose and was a direct cause for the death while a second failure was that nurse Smith did not oversee the drug being given.
Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death
Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death
Nurse Sparrow told the inquest she had not expected nurse Smith to watch her give the potassium as 'no-one ever did'.
An official Trust report said no error was found with the infusion pump and investigators ruled the death was due to 'individual, human error'.
A Trust action plan after the death saw new infusion pumps and software that reduce the risk of error brought into all wards, medical staff retrained and warned over the dangers of potassium chloride and advice on the importance of a second nurse witnessing medication being given.
Birmingham coroner Aidan Cotter gave a verdict of accidental death to which neglect contributed.
In true Daily Mail style the story is hyped under the title "Mother-of-four dies after blundering nurse administers TEN times drug overdose"
80 year old Arsula Samson died on 14 March 2010 at Good Hope Hospital, Birmingham after she was given an overdose of deadly potassium chloride.
According to the inquest staff nurse Lisa Sparrow wrongly administered 50ml of the drug over half an hour instead of over five hours, the inquest heard.
Instead of pressing the 10ml per hour button, the nurse admitted tapping in 100ml per hour on the drug infusion pump.
Staff nurse Sparrow signed out the medication from the controlled drug stock cupboard with staff nurse Susan Smith, as two people were supposed to administer and check the drug together to avoid any errors under hospital policy.
But nurse Smith left nurse Sparrow to give the drug on her own when the error happened. The coroner said that nurse Sparrow's gross failure resulted in the overdose and was a direct cause for the death while a second failure was that nurse Smith did not oversee the drug being given.
Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death
Mrs Samson was suffering from pneumonia when she was given the massive overdose that led to her death
Nurse Sparrow told the inquest she had not expected nurse Smith to watch her give the potassium as 'no-one ever did'.
An official Trust report said no error was found with the infusion pump and investigators ruled the death was due to 'individual, human error'.
A Trust action plan after the death saw new infusion pumps and software that reduce the risk of error brought into all wards, medical staff retrained and warned over the dangers of potassium chloride and advice on the importance of a second nurse witnessing medication being given.
Birmingham coroner Aidan Cotter gave a verdict of accidental death to which neglect contributed.
Sunday, February 20, 2011
Vietnam boat sinking: Human error blamed, two arrested
BBC Website 20 February 2011
Human error was to blame for the sinking of a tourist boat in Vietnam which killed 12 people, including one Briton, Vietnamese police have said.
Quang Ninh police spokesman Le Thanh Binh said a valve that allowed water to come into the boat to cool the engine had been left open overnight.
Stuart McCormick, 30, from Irvine, Ayrshire, died with 11 holidaymakers and a Vietnamese guide in Halong Bay.
The vessel's captain and a crew member have been arrested.
The wooden boat was touring the Unesco World Heritage Site in Quang Ninh province when it went down.
Speaking to Associated Press news agency, Mr Binh said: "The initial police investigation showed that the man in charge of the boat engine forgot to close the valve that allowed water in to cool the engine before he, the captain and other crew went to bed."
The engine was turned off, preventing a pump from running to push the water out.
By the time the captain and crew woke to find the boat filled with water, it was too late and the vessel sank quickly, he said.
Human error was to blame for the sinking of a tourist boat in Vietnam which killed 12 people, including one Briton, Vietnamese police have said.
Quang Ninh police spokesman Le Thanh Binh said a valve that allowed water to come into the boat to cool the engine had been left open overnight.
Stuart McCormick, 30, from Irvine, Ayrshire, died with 11 holidaymakers and a Vietnamese guide in Halong Bay.
The vessel's captain and a crew member have been arrested.
The wooden boat was touring the Unesco World Heritage Site in Quang Ninh province when it went down.
Speaking to Associated Press news agency, Mr Binh said: "The initial police investigation showed that the man in charge of the boat engine forgot to close the valve that allowed water in to cool the engine before he, the captain and other crew went to bed."
The engine was turned off, preventing a pump from running to push the water out.
By the time the captain and crew woke to find the boat filled with water, it was too late and the vessel sank quickly, he said.
Thursday, February 17, 2011
Human factors performance indicators
Published by Energy Institute in 2010 and available from the EI Website
The report explores what performance indicators are and how they are used, and proposes a methodology for selecting human factors performance indicators for each of the HSE top 10 key human factors issues. The report also provides a list of example human factors performance indicators which are already being used by industry or which could potentially be used.
The report explores what performance indicators are and how they are used, and proposes a methodology for selecting human factors performance indicators for each of the HSE top 10 key human factors issues. The report also provides a list of example human factors performance indicators which are already being used by industry or which could potentially be used.
Sunday, February 06, 2011
Slug kills teen girl driver
Articles in The Sun and Express on 31 January 2011
Katie Dagley, 19, was killed in a head-on collision on a brige at Alvecote, near Tamworth, West Midlands.
The bridge was single track, with traffic lights to only allow vehicles to travel one way at a time. An investigation found that the traffic lights had malfunctioned 20 minutes before the crash. There was a trail across the circuit board and it had short-circuited it.
The driver of the, James Cope, 18, told how he saw Katie's car but did not have time to brake.
Katie Dagley, 19, was killed in a head-on collision on a brige at Alvecote, near Tamworth, West Midlands.
The bridge was single track, with traffic lights to only allow vehicles to travel one way at a time. An investigation found that the traffic lights had malfunctioned 20 minutes before the crash. There was a trail across the circuit board and it had short-circuited it.
The driver of the, James Cope, 18, told how he saw Katie's car but did not have time to brake.
Friday, February 04, 2011
Proposed regulation by FAA closes human factors loophole
Article on Flightglobal website by John Croft 2 February 2011
The US Federal Aviation Authority (FAA) is proposing to close a human factors loophole in the regulations governing the certification of transport category aircraft with increasingly advanced-technology integrated flight decks.
In a notice of proposed rulemaking (NPRM) to be issued on 3 February, the agency calls for creating more explicit requirements for "design attributes" related to "managing and avoiding" pilot errors, including being able to detect and recover from keypad errors.
"In hindsight of analysis of accidents, incidents or other events of interest, these deviations might include: an inappropriate action, a difference for what is expected in a procedure, a mistaken decision, a slip of the fingers in typing, an omission of some kind, and many other examples," says the agency in the NPRM.
The US Federal Aviation Authority (FAA) is proposing to close a human factors loophole in the regulations governing the certification of transport category aircraft with increasingly advanced-technology integrated flight decks.
In a notice of proposed rulemaking (NPRM) to be issued on 3 February, the agency calls for creating more explicit requirements for "design attributes" related to "managing and avoiding" pilot errors, including being able to detect and recover from keypad errors.
"In hindsight of analysis of accidents, incidents or other events of interest, these deviations might include: an inappropriate action, a difference for what is expected in a procedure, a mistaken decision, a slip of the fingers in typing, an omission of some kind, and many other examples," says the agency in the NPRM.
Thursday, February 03, 2011
Safety on the Front Lines
Article in Aviation Week by Heather Baldwin on 1 February 2011
I'm a bit surprised that the article is written as if human factors is a new idea in the aviation industry, but it does give some good examples of problems. For example taken from a survey of maintenance managers:
* More than half think their employees complete jobs despite the non-availability of specified tools or equipment.
* 16% said they believe their employees have signed off for uncompleted work due to limited time or resources.
* One in 10 managers admitted their line supervisors would approve a mechanic’s actions if he didn’t follow procedures in order to get an aircraft out.
* 26% of technicians believe that their immediate bosses would approve of their actions if they did not follow procedures in order to speed up their work on an aircraft
"An error is rarely the sole fault of an individual; rather, it often is driven by organizational pressures, expectations and unwritten policies."
A technician was fired because, in violation of regulations, he walked an aircraft back solo one night and damaged it. On the surface, it might appear to be the poor judgment of a single individual. In fact, the organization where this occurred had cut back so severely due to cost pressures that it didn’t have the manpower for two wing walkers on the midnight shift. Consequently, under pressure to get the work done, technicians routinely moved airplanes with one walker.
"Maintenance errors are the consequences of the processes, decisions and culture established by the organization."
JetBlue Airways has many safety initiatives including the "Pocket Session" that requires senior leaders to get out routinely and meet with front-line workers. No one is ever punished for bringing forward a safety concern, employees are encouraged and expected to submit safety reports on all potentially unsafe situations they encounter. Examples of unsafe situations reported include "ramp lighting" and "running engines with passengers onboard." JetBlue says its "injuries, ground damages and other measures, has been better year over year almost every year since we’ve been in operation." "From 2009 to 2010, the injury rate for Tech Ops dropped 83%."
I'm slightly concerned that the article is referring to reduced injury rates at JetBlue with no consideration of whether this is relevant to flight safety.
I'm a bit surprised that the article is written as if human factors is a new idea in the aviation industry, but it does give some good examples of problems. For example taken from a survey of maintenance managers:
* More than half think their employees complete jobs despite the non-availability of specified tools or equipment.
* 16% said they believe their employees have signed off for uncompleted work due to limited time or resources.
* One in 10 managers admitted their line supervisors would approve a mechanic’s actions if he didn’t follow procedures in order to get an aircraft out.
* 26% of technicians believe that their immediate bosses would approve of their actions if they did not follow procedures in order to speed up their work on an aircraft
"An error is rarely the sole fault of an individual; rather, it often is driven by organizational pressures, expectations and unwritten policies."
A technician was fired because, in violation of regulations, he walked an aircraft back solo one night and damaged it. On the surface, it might appear to be the poor judgment of a single individual. In fact, the organization where this occurred had cut back so severely due to cost pressures that it didn’t have the manpower for two wing walkers on the midnight shift. Consequently, under pressure to get the work done, technicians routinely moved airplanes with one walker.
"Maintenance errors are the consequences of the processes, decisions and culture established by the organization."
JetBlue Airways has many safety initiatives including the "Pocket Session" that requires senior leaders to get out routinely and meet with front-line workers. No one is ever punished for bringing forward a safety concern, employees are encouraged and expected to submit safety reports on all potentially unsafe situations they encounter. Examples of unsafe situations reported include "ramp lighting" and "running engines with passengers onboard." JetBlue says its "injuries, ground damages and other measures, has been better year over year almost every year since we’ve been in operation." "From 2009 to 2010, the injury rate for Tech Ops dropped 83%."
I'm slightly concerned that the article is referring to reduced injury rates at JetBlue with no consideration of whether this is relevant to flight safety.
Thursday, January 13, 2011
NASA Rolls Out New Technology in 3D Simulation
Article from Industrial Week 12 January 2011 by Peter Schmitt and Les Goldberg
In the past, NASA's design effort has been focussed on flight operations. As a result, very little consideration was given to manufacturing processes or human factors engineering. The argument was "If you're spending money on ground operations, you're not spending it on in-space operations."
The scenarios that resulted from this included:
* A spacecraft would be built without any thought given to how it would be transported to the launch site
* Ground operations were only developed after the spacecraft had been built and transported to the launch site
* Engineers had to develop "work-arounds" for nearly every task required to prepare the vehicle for launch, making the space shuttle very expensive to operate.
The article says that the availability of 3D digital manufacturing software to simulate operations at all stages of the operation have led to significant improvement. I think I would argue that, whilst the technology must have helped, it would have required a significant cultural change to start thinking about human factors for the whole project.
Examples of improvements that have been achieved include:
* Simulating a welding process identified that the welding head would collide with other hardware. Parts were changed during the design, avoiding problems during manufacture.
* Simulating how a person would interact with a vehicle to secure it to a barge for transport allows features to be incorporated to ensure that humans have access to, and can reach the hardware they need to perform tie-down operations.
* Simulating a two crane lifting operation allowed detailed instructions to be developed prior to the operation, validating its safety.
Introducing these tools at the outset of a program reduces manufacturing and ground operations costs, and fundamentally changes the way NASA engineers operate.
It has improved relationships between engineers at different facilities. Money saved on manufacturing and ground operations can be spent on exploration and in-flight activities.
In the past, NASA's design effort has been focussed on flight operations. As a result, very little consideration was given to manufacturing processes or human factors engineering. The argument was "If you're spending money on ground operations, you're not spending it on in-space operations."
The scenarios that resulted from this included:
* A spacecraft would be built without any thought given to how it would be transported to the launch site
* Ground operations were only developed after the spacecraft had been built and transported to the launch site
* Engineers had to develop "work-arounds" for nearly every task required to prepare the vehicle for launch, making the space shuttle very expensive to operate.
The article says that the availability of 3D digital manufacturing software to simulate operations at all stages of the operation have led to significant improvement. I think I would argue that, whilst the technology must have helped, it would have required a significant cultural change to start thinking about human factors for the whole project.
Examples of improvements that have been achieved include:
* Simulating a welding process identified that the welding head would collide with other hardware. Parts were changed during the design, avoiding problems during manufacture.
* Simulating how a person would interact with a vehicle to secure it to a barge for transport allows features to be incorporated to ensure that humans have access to, and can reach the hardware they need to perform tie-down operations.
* Simulating a two crane lifting operation allowed detailed instructions to be developed prior to the operation, validating its safety.
Introducing these tools at the outset of a program reduces manufacturing and ground operations costs, and fundamentally changes the way NASA engineers operate.
It has improved relationships between engineers at different facilities. Money saved on manufacturing and ground operations can be spent on exploration and in-flight activities.
LSE says human error, not sabotage, caused crash
Article from Reuters 11 January 2011 by Luke Jeffs
Having initially citing "suspicious circumstances" and calling the police, the LSE has now announced that "The investigation found the incident was the result of human error and the incident has now been closed." No further details were provided.
I am not sure if we are supposed to be reassured by this statement. Have any system or organisational changes been made to prevent a recurrence? Or have they just reprimanded the human who made the error?
Having initially citing "suspicious circumstances" and calling the police, the LSE has now announced that "The investigation found the incident was the result of human error and the incident has now been closed." No further details were provided.
I am not sure if we are supposed to be reassured by this statement. Have any system or organisational changes been made to prevent a recurrence? Or have they just reprimanded the human who made the error?
Tuesday, January 11, 2011
Oil Spill Commission - Final Report
Published 11 January 2011 and available at http://www.oilspillcommission.gov/sites/default/files/documents/DEEPWATER_ReporttothePresident_FINAL.pdf
Publishing a report that is nearly 400 pages long, it may be concluded that the Commission is trying to cover up information by overwhelming us with data. The early release of a single chapter a week earlier may be further evidence of some slight of hand going on.
The report reads almost like a novel in places, and includes a lot of history of the oil industry going right back to the 1890s. The fact that the Commission chose to title the report "Deep Water" does little to reassure me that we are receiving an objective or useful view of what caused the disaster, and how it can be avoided in the future.
I've only skimmed through the report. Below are a few sections I have picked out that appear to be particularly interesting or useful. I have included page numbers so that you can find the sections in the report if you wish.
The Blow Out Preventer did not work, and I was aware that there were some issues regarding previous modifications. This is covered on Page 137 of the report:
As the National Incident Command took shape in early May, BP’s efforts to stop the flow of oil continued to focus on actuating the BOP, which BP still believed was the best chance of quickly shutting in the well. These efforts were plagued by engineering and organizational problems. For instance, it took nearly 10 days for a Transocean representative to realize that the stack’s plumbing differed from the diagrams on which BP and Transocean were relying, and to inform the engineers attempting to trigger one of the BOP’s rams through a hydraulic panel that they had been misdirecting their efforts.
(Without properly recording the change, Transocean had reconfigured the BOP; the panel that was supposed to control that ram actually operated a different, “test” ram, which could not stop the flow of oil and gas. BP Vice President Harry Thierens, who was BP’s lead on BOP interventions, stated afterward that he was “quite frankly astonished that this could have happened.”) While this and other problems delayed BP’s efforts, the flow of oil and sand continued to wear down the BOP’s parts, making closure more difficult.
One thing I wanted from the report was clear indication of how bad the environmental damage really was as a result of the oil spill. The report suggests that it was far less than was often suggested. In fact it appears to me that American politicians may have been tempted to exaggerate in an effort to put more pressure on BP.
Page 155 of the report includes the following from a Gulf resident. "What’s funny,” Lindsay said, “is we only had about three bad weeks where oil was washing on shore and BP was staging clean-up on the beach. That was in June. The rest of the summer the beaches were pretty much clean but folks still didn’t come down.”
The report gives some idea of the the impact on nature. There does not seem to be anything like a clear picture, partly because conditions prior to the disaster where not known in any detail. Page 174 of the report includes the following.
"The Deepwater Horizon oil spill immediately threatened a rich, productive marine ecosystem. To mitigate both direct and indirect adverse environmental impacts, BP and the federal government took proactive measures in response to the unprecedented magnitude of the spill. Unfortunately, comprehensive data on conditions before the spill—the natural “status quo ante” from the shoreline to the deepwater Gulf—were generally lacking. Even now, information on the nature of the damage associated with the released oil is being realized in bits and pieces: reports of visibly oiled and dead wildlife, polluted marshes, and lifeless deepwater corals. Moreover, scientific knowledge of deepwater marine communities is limited, and it is there that a significant volume of oil was dispersed from the wellhead, naturally and chemically, into small droplets. Scientists simply do not yet know how to predict the ecological consequences and effects on key species that might result from oil exposure in the water column, both far below and near the surface.
Much more oil might have made landfall, but currents and winds kept most of the oil offshore, and a large circulating eddy kept oil from riding the Loop Current toward the Florida Keys. Oil-eating microbes probably broke down a substantial volume of the spilled crude, and the warm temperatures aided degradation and evaporation—favorable conditions not present in colder offshore energy regions. (Oil-degrading microbes are still active in cold water, but less so than in warmer water.) However widespread (and in many cases severe) the natural resource damages are, those observed so far have fallen short of some of the worst expectations and reported conjectures during the early stages of the spill. So much remains unknown that will only become clearer after long-term monitoring of the marine ecosystem. Government scientists (funded by the responsible party) are undertaking a massive effort to assess the damages to the public’s natural resources. Additionally, despite significant delays in funding and lack of timely access to the response zone, independent scientific research of coastal and marine impacts is proceeding as well.
Page 176 of the report
The oil that made landfall was fairly “weathered,” consisting of emulsions of crude oil and depleted of its more volatile components. More than 650 miles of Gulf coastal habitats— salt marsh, mudflat, mangroves, and sand beaches—were oiled; more than 130 miles have been designated as moderately to heavily oiled. Louisiana’s fragile delta habitats bore the brunt of the damage, with approximately 20 additional miles of Mississippi, Alabama, and Florida shorelines moderately to heavily oiled. Light oiling and tar balls extended east to Panama City, Florida. Except for occasional tarballs, Deepwater Horizon oil never reached Texas or the tourism centers along the southwest Florida coast.
Page 189
In early May, to show that their pristine beaches were still sugary white, “We started filming daily and sometimes twice daily a video for YouTube called Shore Shots. It involved one of my employees standing in front of the camera and showing the Gulf of Mexico and the lack of oil despite being told otherwise. . . . It was not always well received. We were called liars when we said we didn’t have oil on the beaches and told we were poisoning people with Corexit for our own greedy gain. It was definitely tough. “By July the oil was here. No way I could prevent it from coming on – revenue dropped significantly. By August it was awful. No one, I mean no one, believed that we weren’t covered in oil similar to the Exxon Valdez.”
Is it a coincidence that negative information about Transocean and Haliburton is hidden over 200 pages into the report?
Page 224 of the report shows that Transocean's culture and systems may have had some serious weaknesses.
A survey of the Transocean crew regarding “safety management and safety culture” on the Deepwater Horizon conducted just a few weeks before the accident hints at the organizational roots of the problem. The research, conducted at Transocean’s request, involved surveys and interviews with hundreds of employees onshore and on four rigs, including Deepwater Horizon, which was surveyed from March 12 to March 16. The reviewers found Deepwater Horizon “relatively strong in many of the core aspects of safety management.” But there were also weaknesses. Some 46 percent of crew members surveyed felt that some of the workforce feared reprisals for reporting unsafe situations, and 15 percent felt that there were not always enough people available to carry out work safely. Some Transocean crews complained that the safety manual was “unstructured,” “hard to navigate,” and “not written with the end user in mind”; and that there is “poor distinction between what is required and how this should be achieved.” According to the final survey report, Transocean’s crews “don’t always know what they don’t know. [F]ront line crews are potentially working with a mindset that they believe they are fully aware of all the hazards when it’s highly likely that they are not.”
Also, on the same Page 224 there appears to be some really damming information about Halibuton's cementing
Halliburton prepared cement for the Macondo well that had repeatedly failed Halliburton’s own laboratory tests (see Chapter 4). And then, despite those test results, Halliburton managers onshore let its crew and those of Transocean and BP on the Deepwater Horizon continue with the cement job apparently without first ensuring good stability results.
Halliburton also was the cementer on a well that suffered a blowout in August 2009, in the Timor Sea off Australia. The Montara rig caught fire and a well leaked tens of thousands of barrels of oil over two and a half months before it was shut down. The leak occurred because the cement seal failed, the government report into the accident found. However, the report said it would not be appropriate to criticize Halliburton, because the operator “exercised overall control over and responsibility for cementing operations.” The inquiry concluded that “Halliburton was not required or expected to ‘value add’ by doing
more than complying with [the operator’s] instructions.” In this, Montara offers yet another example of a lack of communication between operators and service providers and of the gaps between the silos of expertise that exist in the deepwater oil and gas industry.
The final section I have copied here seems to suggest that that American Petroleum Institute (API) were to blame for poor regulation. I'm not sure I quite follow the logic behind the text on Page 228 of the report
For years, API also led the effort to persuade the Minerals Management Service not to adopt a new regulatory approach—the Safety and Environmental Management System (SEMS)—and instead has favored relying on voluntary, recommended safety practices.
Safety and environmental management systems are used in similar forms in other parts of the world and many credit them with the better safety records achieved outside U.S. waters (see Chapter 3). Beginning early in the last decade, the trade organization steadfastly resisted MMS’s efforts to require all companies to demonstrate that they have a complete safety and environmental management system in addition to meeting more traditional, prescriptive regulations—despite the fact that this is the direction taken in other countries in response to the Piper Alpha rig explosion in the late 1980s. Indeed, many operators in the Gulf were used to this safety-based approach on their rigs in the North Sea and Canada. It was not until this past September—after the Macondo blowout—that the Department of the Interior was finally able to announce a new, mandatory Safety and Environmental Management System: almost two decades after the approach was adopted in the United Kingdom, where it is called the “safety case.” Moreover, API opposed revisions to the incident reporting rule that would have helped better identify safety risks
Publishing a report that is nearly 400 pages long, it may be concluded that the Commission is trying to cover up information by overwhelming us with data. The early release of a single chapter a week earlier may be further evidence of some slight of hand going on.
The report reads almost like a novel in places, and includes a lot of history of the oil industry going right back to the 1890s. The fact that the Commission chose to title the report "Deep Water" does little to reassure me that we are receiving an objective or useful view of what caused the disaster, and how it can be avoided in the future.
I've only skimmed through the report. Below are a few sections I have picked out that appear to be particularly interesting or useful. I have included page numbers so that you can find the sections in the report if you wish.
The Blow Out Preventer did not work, and I was aware that there were some issues regarding previous modifications. This is covered on Page 137 of the report:
As the National Incident Command took shape in early May, BP’s efforts to stop the flow of oil continued to focus on actuating the BOP, which BP still believed was the best chance of quickly shutting in the well. These efforts were plagued by engineering and organizational problems. For instance, it took nearly 10 days for a Transocean representative to realize that the stack’s plumbing differed from the diagrams on which BP and Transocean were relying, and to inform the engineers attempting to trigger one of the BOP’s rams through a hydraulic panel that they had been misdirecting their efforts.
(Without properly recording the change, Transocean had reconfigured the BOP; the panel that was supposed to control that ram actually operated a different, “test” ram, which could not stop the flow of oil and gas. BP Vice President Harry Thierens, who was BP’s lead on BOP interventions, stated afterward that he was “quite frankly astonished that this could have happened.”) While this and other problems delayed BP’s efforts, the flow of oil and sand continued to wear down the BOP’s parts, making closure more difficult.
One thing I wanted from the report was clear indication of how bad the environmental damage really was as a result of the oil spill. The report suggests that it was far less than was often suggested. In fact it appears to me that American politicians may have been tempted to exaggerate in an effort to put more pressure on BP.
Page 155 of the report includes the following from a Gulf resident. "What’s funny,” Lindsay said, “is we only had about three bad weeks where oil was washing on shore and BP was staging clean-up on the beach. That was in June. The rest of the summer the beaches were pretty much clean but folks still didn’t come down.”
The report gives some idea of the the impact on nature. There does not seem to be anything like a clear picture, partly because conditions prior to the disaster where not known in any detail. Page 174 of the report includes the following.
"The Deepwater Horizon oil spill immediately threatened a rich, productive marine ecosystem. To mitigate both direct and indirect adverse environmental impacts, BP and the federal government took proactive measures in response to the unprecedented magnitude of the spill. Unfortunately, comprehensive data on conditions before the spill—the natural “status quo ante” from the shoreline to the deepwater Gulf—were generally lacking. Even now, information on the nature of the damage associated with the released oil is being realized in bits and pieces: reports of visibly oiled and dead wildlife, polluted marshes, and lifeless deepwater corals. Moreover, scientific knowledge of deepwater marine communities is limited, and it is there that a significant volume of oil was dispersed from the wellhead, naturally and chemically, into small droplets. Scientists simply do not yet know how to predict the ecological consequences and effects on key species that might result from oil exposure in the water column, both far below and near the surface.
Much more oil might have made landfall, but currents and winds kept most of the oil offshore, and a large circulating eddy kept oil from riding the Loop Current toward the Florida Keys. Oil-eating microbes probably broke down a substantial volume of the spilled crude, and the warm temperatures aided degradation and evaporation—favorable conditions not present in colder offshore energy regions. (Oil-degrading microbes are still active in cold water, but less so than in warmer water.) However widespread (and in many cases severe) the natural resource damages are, those observed so far have fallen short of some of the worst expectations and reported conjectures during the early stages of the spill. So much remains unknown that will only become clearer after long-term monitoring of the marine ecosystem. Government scientists (funded by the responsible party) are undertaking a massive effort to assess the damages to the public’s natural resources. Additionally, despite significant delays in funding and lack of timely access to the response zone, independent scientific research of coastal and marine impacts is proceeding as well.
Page 176 of the report
The oil that made landfall was fairly “weathered,” consisting of emulsions of crude oil and depleted of its more volatile components. More than 650 miles of Gulf coastal habitats— salt marsh, mudflat, mangroves, and sand beaches—were oiled; more than 130 miles have been designated as moderately to heavily oiled. Louisiana’s fragile delta habitats bore the brunt of the damage, with approximately 20 additional miles of Mississippi, Alabama, and Florida shorelines moderately to heavily oiled. Light oiling and tar balls extended east to Panama City, Florida. Except for occasional tarballs, Deepwater Horizon oil never reached Texas or the tourism centers along the southwest Florida coast.
Page 189
In early May, to show that their pristine beaches were still sugary white, “We started filming daily and sometimes twice daily a video for YouTube called Shore Shots. It involved one of my employees standing in front of the camera and showing the Gulf of Mexico and the lack of oil despite being told otherwise. . . . It was not always well received. We were called liars when we said we didn’t have oil on the beaches and told we were poisoning people with Corexit for our own greedy gain. It was definitely tough. “By July the oil was here. No way I could prevent it from coming on – revenue dropped significantly. By August it was awful. No one, I mean no one, believed that we weren’t covered in oil similar to the Exxon Valdez.”
Is it a coincidence that negative information about Transocean and Haliburton is hidden over 200 pages into the report?
Page 224 of the report shows that Transocean's culture and systems may have had some serious weaknesses.
A survey of the Transocean crew regarding “safety management and safety culture” on the Deepwater Horizon conducted just a few weeks before the accident hints at the organizational roots of the problem. The research, conducted at Transocean’s request, involved surveys and interviews with hundreds of employees onshore and on four rigs, including Deepwater Horizon, which was surveyed from March 12 to March 16. The reviewers found Deepwater Horizon “relatively strong in many of the core aspects of safety management.” But there were also weaknesses. Some 46 percent of crew members surveyed felt that some of the workforce feared reprisals for reporting unsafe situations, and 15 percent felt that there were not always enough people available to carry out work safely. Some Transocean crews complained that the safety manual was “unstructured,” “hard to navigate,” and “not written with the end user in mind”; and that there is “poor distinction between what is required and how this should be achieved.” According to the final survey report, Transocean’s crews “don’t always know what they don’t know. [F]ront line crews are potentially working with a mindset that they believe they are fully aware of all the hazards when it’s highly likely that they are not.”
Also, on the same Page 224 there appears to be some really damming information about Halibuton's cementing
Halliburton prepared cement for the Macondo well that had repeatedly failed Halliburton’s own laboratory tests (see Chapter 4). And then, despite those test results, Halliburton managers onshore let its crew and those of Transocean and BP on the Deepwater Horizon continue with the cement job apparently without first ensuring good stability results.
Halliburton also was the cementer on a well that suffered a blowout in August 2009, in the Timor Sea off Australia. The Montara rig caught fire and a well leaked tens of thousands of barrels of oil over two and a half months before it was shut down. The leak occurred because the cement seal failed, the government report into the accident found. However, the report said it would not be appropriate to criticize Halliburton, because the operator “exercised overall control over and responsibility for cementing operations.” The inquiry concluded that “Halliburton was not required or expected to ‘value add’ by doing
more than complying with [the operator’s] instructions.” In this, Montara offers yet another example of a lack of communication between operators and service providers and of the gaps between the silos of expertise that exist in the deepwater oil and gas industry.
The final section I have copied here seems to suggest that that American Petroleum Institute (API) were to blame for poor regulation. I'm not sure I quite follow the logic behind the text on Page 228 of the report
For years, API also led the effort to persuade the Minerals Management Service not to adopt a new regulatory approach—the Safety and Environmental Management System (SEMS)—and instead has favored relying on voluntary, recommended safety practices.
Safety and environmental management systems are used in similar forms in other parts of the world and many credit them with the better safety records achieved outside U.S. waters (see Chapter 3). Beginning early in the last decade, the trade organization steadfastly resisted MMS’s efforts to require all companies to demonstrate that they have a complete safety and environmental management system in addition to meeting more traditional, prescriptive regulations—despite the fact that this is the direction taken in other countries in response to the Piper Alpha rig explosion in the late 1980s. Indeed, many operators in the Gulf were used to this safety-based approach on their rigs in the North Sea and Canada. It was not until this past September—after the Macondo blowout—that the Department of the Interior was finally able to announce a new, mandatory Safety and Environmental Management System: almost two decades after the approach was adopted in the United Kingdom, where it is called the “safety case.” Moreover, API opposed revisions to the incident reporting rule that would have helped better identify safety risks
Thursday, January 06, 2011
Commission Releases Chapter on BP Well Blowout Investigation in Advance of Full Report
6 January 2011
Summary of the Chapter available here
Full chapter available here
Key messages include:
"The well blew out because a number of separate risk factors, oversights, and outright mistakes combined to overwhelm the safeguards meant to prevent just such an event from happening. But most of the mistakes and oversights at Macondo can be traced back to a single overarching failure—a failure of management. Better management by BP, Halliburton, and Transocean would almost certainly have prevented the blowout by improving the ability of individuals involved to identify the risks they faced, and to properly evaluate, communicate, and address them."
". . .the Macondo blowout was the product of several individual missteps and oversights by BP, Halliburton, and Transocean, which government regulators lacked the authority, the necessary resources, and the technical expertise to prevent.”
“The blowout was not the product of a series of aberrational decisions made by rogue industry or government officials that could not have been anticipated or expected to occur again. Rather, the root causes are systemic and, absent significant reform in both industry practices and government policies, might well recur."
I'm not really sure why this chapter has been released early. It doesn't seem to say much that was not covered in BP's own report, which they published four months ago in September 2010.
I can't help thinking there is a political motive. The summary released seems to be leading up to the a change of emphasis, from blaming BP for the accident to a shared responsibility. Equally I note that the name of the disaster changes from "BP Well Blowout" to "Macondo blowout" depending on the message.
I am still waiting to see reports from Transocean and Haliburton. Surely they have had the time to write them!
Summary of the Chapter available here
Full chapter available here
Key messages include:
"The well blew out because a number of separate risk factors, oversights, and outright mistakes combined to overwhelm the safeguards meant to prevent just such an event from happening. But most of the mistakes and oversights at Macondo can be traced back to a single overarching failure—a failure of management. Better management by BP, Halliburton, and Transocean would almost certainly have prevented the blowout by improving the ability of individuals involved to identify the risks they faced, and to properly evaluate, communicate, and address them."
". . .the Macondo blowout was the product of several individual missteps and oversights by BP, Halliburton, and Transocean, which government regulators lacked the authority, the necessary resources, and the technical expertise to prevent.”
“The blowout was not the product of a series of aberrational decisions made by rogue industry or government officials that could not have been anticipated or expected to occur again. Rather, the root causes are systemic and, absent significant reform in both industry practices and government policies, might well recur."
I'm not really sure why this chapter has been released early. It doesn't seem to say much that was not covered in BP's own report, which they published four months ago in September 2010.
I can't help thinking there is a political motive. The summary released seems to be leading up to the a change of emphasis, from blaming BP for the accident to a shared responsibility. Equally I note that the name of the disaster changes from "BP Well Blowout" to "Macondo blowout" depending on the message.
I am still waiting to see reports from Transocean and Haliburton. Surely they have had the time to write them!
Thursday, December 30, 2010
Lessons Learned From Maintenance Mergers
Article at Aviation Week by Heather Baldwin on 23 December 2010
Quoting Hal Heule, president of HMH Consulting, who was senior VP technical operations during the America West-US Airways merger.
"There are three standout issues maintenance organizations should have a plan to address."
1. Communication. The announcement of a merger causes immediate distraction in any workplace. (Will I have a job, will it change, will I have to move?). "It is important to address them head-on, repeatedly, with solid information. Otherwise, rumors and misinformation will take over and degrade job performance, increasing the likelihood of a maintenance error."
2. Training. Heule’s biggest “lesson learned” from the America West-US Airways merger was in the area of training. “I wish we’d done more of it, and I wish we had done it better,” he says. If he had to do it all again, he would "beef up the training department and slow down the training process, devoting more time, attention and resources to this critical area." By neglecting the “why” in training people try to answer it themselves and overlook what they need to learn about the new organisation. If employees are not 100% onboard with why the new way will be better, that limits their ability to engage with the material.
3. Integration workload. Not surprisingly, it takes a lot of work to integrate two major airlines. Maintenance leaders cannot expect to handle the added workload and still fully perform their jobs.
Where there are redundancies, consider redeploying personnel to areas such as training, which need more attention. Another option is to split the workload: give one person responsibility for merger issues while another runs the day-to-day airline operations.
Taking the time to manage communications, plan out training that addresses the “why” behind forthcoming changes, and keeping all maintenance personnel employed through the merger—even if it means assigning new, merger-related responsibilities—vastly reduces the human factors issues that can lead to error.
Quoting Hal Heule, president of HMH Consulting, who was senior VP technical operations during the America West-US Airways merger.
"There are three standout issues maintenance organizations should have a plan to address."
1. Communication. The announcement of a merger causes immediate distraction in any workplace. (Will I have a job, will it change, will I have to move?). "It is important to address them head-on, repeatedly, with solid information. Otherwise, rumors and misinformation will take over and degrade job performance, increasing the likelihood of a maintenance error."
2. Training. Heule’s biggest “lesson learned” from the America West-US Airways merger was in the area of training. “I wish we’d done more of it, and I wish we had done it better,” he says. If he had to do it all again, he would "beef up the training department and slow down the training process, devoting more time, attention and resources to this critical area." By neglecting the “why” in training people try to answer it themselves and overlook what they need to learn about the new organisation. If employees are not 100% onboard with why the new way will be better, that limits their ability to engage with the material.
3. Integration workload. Not surprisingly, it takes a lot of work to integrate two major airlines. Maintenance leaders cannot expect to handle the added workload and still fully perform their jobs.
Where there are redundancies, consider redeploying personnel to areas such as training, which need more attention. Another option is to split the workload: give one person responsibility for merger issues while another runs the day-to-day airline operations.
Taking the time to manage communications, plan out training that addresses the “why” behind forthcoming changes, and keeping all maintenance personnel employed through the merger—even if it means assigning new, merger-related responsibilities—vastly reduces the human factors issues that can lead to error.
Wednesday, December 22, 2010
Motorcycle Simulator Shows Slow Is Not Always Better
Article at AutoEvolution by Alina Dumitrache on 6 December 2010
Study performed by researchers at The University of Nottingham's Centre for Motorcycle Ergonomics & Rider Human Factors used motorcycle simulator to analyse rider behaviour.
Three groups of riders, namely novice, experienced and those who had taken advanced motorcycle training, were out through the same scenarios .
The findings showed that experience on its own does not make riders safer on the road and in some cases the experienced riders behaved more like novice riders. Advanced riders used better road positioning to anticipate and respond to hazards, kept to urban speed limits, and actually made better progress through bends than riders without the formal advanced training.
“It has demonstrated clear differences between the rider groups and potential benefits to advanced training above and beyond rider experience and basic training. Whilst experience seems to help develop rider skills to an extent, advanced training appears to develop deeper levels of awareness, perception and responsibility. It also appears to make riders better urban riders and quicker, smoother and safer riders in rural settings," said Alex Stedmon from the Human Factors Research Group.
Study performed by researchers at The University of Nottingham's Centre for Motorcycle Ergonomics & Rider Human Factors used motorcycle simulator to analyse rider behaviour.
Three groups of riders, namely novice, experienced and those who had taken advanced motorcycle training, were out through the same scenarios .
The findings showed that experience on its own does not make riders safer on the road and in some cases the experienced riders behaved more like novice riders. Advanced riders used better road positioning to anticipate and respond to hazards, kept to urban speed limits, and actually made better progress through bends than riders without the formal advanced training.
“It has demonstrated clear differences between the rider groups and potential benefits to advanced training above and beyond rider experience and basic training. Whilst experience seems to help develop rider skills to an extent, advanced training appears to develop deeper levels of awareness, perception and responsibility. It also appears to make riders better urban riders and quicker, smoother and safer riders in rural settings," said Alex Stedmon from the Human Factors Research Group.
Why we must always factor in the human element
Article on Arabia Aerospace website by Ali Al Naqbi on 8 December 2010
Increasing automation on the flight deck is supposed to improve safety – but many pilots are questioning whether, in fact, automation overload is putting aircraft at risk. Research into human factors has thrown up some evidence that cultural differences may not be adequately considered in automation design, training, certification, and operations. If they are not factored in, they may have resulting effects on performance and how automation is used.
At the same time, automation design may not be guided by a philosophy that gives adequate attention to the proper role and function of the human and to human capabilities and limitations. This may compromise system effectiveness and safety.
Pilots from different cultural backgrounds should be involved in the basic design of the avionics functions and of the training systems.
Increasing automation on the flight deck is supposed to improve safety – but many pilots are questioning whether, in fact, automation overload is putting aircraft at risk. Research into human factors has thrown up some evidence that cultural differences may not be adequately considered in automation design, training, certification, and operations. If they are not factored in, they may have resulting effects on performance and how automation is used.
At the same time, automation design may not be guided by a philosophy that gives adequate attention to the proper role and function of the human and to human capabilities and limitations. This may compromise system effectiveness and safety.
Pilots from different cultural backgrounds should be involved in the basic design of the avionics functions and of the training systems.
IEHF Oil & Gas conference
Taking the time to reflect back on the Institute of Ergonomics and Human Factors (IEHF) conference in November titled Human & Organisational factors in the oil, gas and chemical industries - More information here
Jim Wetherby, ex Space Shuttle pilot and now working for BP in the US, made a very interesting observation. After the Deepwater Horizon oil platform was lost, relief wells were drilled. These represented the same technical challenges as the original well, and were carried out by the same companies (Transocean drillers, Haliburton cement) yet were delivered ahead of time without incident. So it is not the case that the organisation could not drill for oil in deep waters. But it is easy to forget how dangerous these activities can be, and this complacency leads to critical items being overlooked and forgotten.
The presentation "Not on my shift" by George Petrie (Petrofac) showed how a focus on avoiding problems can work at the sharp end. This involves giving supervisors real ownership of safety, making them feel personally responsible for what happens when they are in charge.
At a higher level, the presentation from Caroline Sugden (HSL) and Peter Jefferies (ConocoPhillips) illustrated the concept of a high reliability organisation, which is one that manages to maintain almost error-free performance. These organisations have a certain set of characteristics including an 'intelligent wariness' and knowing where the 'edges of the safety envolope' are.
I felt these three presentations really gave us an insight into a future direction for safety management, culture etc. They were in contrast to some of the other presentations that gave a good account of current approaches, which may, in my opinion, be based on too simplistic idea of what really makes the difference between success and an accident.
This was another excellent conference from the Institute, and all presentations were very good. Looking forward to the next in 2012
Jim Wetherby, ex Space Shuttle pilot and now working for BP in the US, made a very interesting observation. After the Deepwater Horizon oil platform was lost, relief wells were drilled. These represented the same technical challenges as the original well, and were carried out by the same companies (Transocean drillers, Haliburton cement) yet were delivered ahead of time without incident. So it is not the case that the organisation could not drill for oil in deep waters. But it is easy to forget how dangerous these activities can be, and this complacency leads to critical items being overlooked and forgotten.
The presentation "Not on my shift" by George Petrie (Petrofac) showed how a focus on avoiding problems can work at the sharp end. This involves giving supervisors real ownership of safety, making them feel personally responsible for what happens when they are in charge.
At a higher level, the presentation from Caroline Sugden (HSL) and Peter Jefferies (ConocoPhillips) illustrated the concept of a high reliability organisation, which is one that manages to maintain almost error-free performance. These organisations have a certain set of characteristics including an 'intelligent wariness' and knowing where the 'edges of the safety envolope' are.
I felt these three presentations really gave us an insight into a future direction for safety management, culture etc. They were in contrast to some of the other presentations that gave a good account of current approaches, which may, in my opinion, be based on too simplistic idea of what really makes the difference between success and an accident.
This was another excellent conference from the Institute, and all presentations were very good. Looking forward to the next in 2012
Thursday, November 04, 2010
US - PHMSA amendment to Federal pipeline safety regulations to address human factors and other aspects of control room management
Notification of amendment from US Department of Transportation - Pipeline and Hazardous Materials
Safety Administration.
Safety regulations are being amended to address human factors and other aspects of control room management for pipelines where controllers use supervisory control and data acquisition (SCADA) systems. Under the final rule, affected pipeline operators must define the roles and responsibilities of controllers and provide controllers with the necessary information, training, and processes to fulfill these responsibilities. Operators must also implement methods to prevent controller fatigue. The final rule further requires operators to manage SCADA alarms, assure control room considerations are taken into account when changing pipeline equipment or configurations, and review reportable incidents or accidents to determine
whether control room actions contributed to the event.
This rule improves opportunities to reduce risk through more effective control of pipelines. These regulations will enhance pipeline safety by coupling strengthened control room management with improved controller training and fatigue management.
Effective control of pipelines is one key component of accident prevention. Controllers can help identify risks, prevent accidents, and minimize commodity loss if provided with the necessary tools and working environment. This rule will increase the likelihood that pipeline controllers have the necessary knowledge, skills, and abilities to help prevent accidents. The rule will also ensure that operators provide controllers with the necessary training, tools, procedures, management support, and environment where a controller’s actions can be effective in
helping to assure safe operation.
Safety Administration.
Safety regulations are being amended to address human factors and other aspects of control room management for pipelines where controllers use supervisory control and data acquisition (SCADA) systems. Under the final rule, affected pipeline operators must define the roles and responsibilities of controllers and provide controllers with the necessary information, training, and processes to fulfill these responsibilities. Operators must also implement methods to prevent controller fatigue. The final rule further requires operators to manage SCADA alarms, assure control room considerations are taken into account when changing pipeline equipment or configurations, and review reportable incidents or accidents to determine
whether control room actions contributed to the event.
This rule improves opportunities to reduce risk through more effective control of pipelines. These regulations will enhance pipeline safety by coupling strengthened control room management with improved controller training and fatigue management.
Effective control of pipelines is one key component of accident prevention. Controllers can help identify risks, prevent accidents, and minimize commodity loss if provided with the necessary tools and working environment. This rule will increase the likelihood that pipeline controllers have the necessary knowledge, skills, and abilities to help prevent accidents. The rule will also ensure that operators provide controllers with the necessary training, tools, procedures, management support, and environment where a controller’s actions can be effective in
helping to assure safe operation.
Wednesday, November 03, 2010
Put your back into it - My brilliant career
Article on the South African Times Live by Margaret Harris on 10 October 2010
It is an interview with Dale Kennedy, an ergonomist and director at consulting firm Ergomax.
I particularly liked Dale's answer to the question "What does an ergonomist do?"
"An ergonomist looks at how working environments affect people. We consider what the human body can and wants to do and design the work environment appropriately to minimise risk exposure, optimise efficiency and maximise profits. Ergonomics marries the occupational health and safety of the workers to the fundamental needs of any business - that of making money."
It is an interview with Dale Kennedy, an ergonomist and director at consulting firm Ergomax.
I particularly liked Dale's answer to the question "What does an ergonomist do?"
"An ergonomist looks at how working environments affect people. We consider what the human body can and wants to do and design the work environment appropriately to minimise risk exposure, optimise efficiency and maximise profits. Ergonomics marries the occupational health and safety of the workers to the fundamental needs of any business - that of making money."
Nuclear submarine freed after running aground off Isle of Skye
Article in The Guardian on 22 October 2010
The Royal Navy's HMS Astute, the world's most advanced submarine, ran aground in familiar waters during an exercise off the Isle of Skye.
The accident is particularly embarrassing as it involves a new state-of-the art vessel, the largest British nuclear-powered attack submarine ever built for the navy. It cost £1.2bn and is equipped with the latest stealth and sonar technology, making it difficult to detect under the sea.
Causes of the incident are likely to cause human error. No details currently available, but the images of the sub stuck on the sea bed make it worth keeping the reference.
The Royal Navy's HMS Astute, the world's most advanced submarine, ran aground in familiar waters during an exercise off the Isle of Skye.
The accident is particularly embarrassing as it involves a new state-of-the art vessel, the largest British nuclear-powered attack submarine ever built for the navy. It cost £1.2bn and is equipped with the latest stealth and sonar technology, making it difficult to detect under the sea.
Causes of the incident are likely to cause human error. No details currently available, but the images of the sub stuck on the sea bed make it worth keeping the reference.
Tuesday, November 02, 2010
Camelford poisoning: 'water authority insisted supplies were safe'
Article in The Guardian 1 November 2010 by Steven Morris
This incident happened in July 1988, but is in the news again because of an inquest into the death of women in 2004 that may have been linked to the contamination of drinking water with aluminium sulphate. The incident is often mentioned when talking about human error, but details have not been available before.
The incident occurred when concentrated aluminium sulphate was transferred to the wrong tank at the Lowermoor plant, which supplied a large area of north Cornwall including Camelford. This meant it was present in the drinking water at a much higher concentration than it should have been.
The driver of the delivery tanker told the inquest how he had stepped in at the last minute to take over the delivery. He was told to put his load "in a tank on the left", but he was confused because there were several tanks and manhole covers.
He said he had asked his colleagues to telephone the authority to say he would be running late but when he arrived at Lowermoor no one was there. He said there was no phone available to ring anyone.
According to the The BBC on 1 November 2010 the driver told the inquest he had let himself into the works with a key given to him by the regular driver Barry Davey. But he did not know the former South West Water Authority, which ran the works, used the same key at all its plants. He had believed the key would let him into the site and open one tank.
In another article from The BBC on 1 November 2010, The chemical was used to treat cloudy water. As well as being too concentrated in the drinking water supply, the acidity in the water also released chemicals in pipe networks into people's homes.
The water company was inundated with around 900 complaints about dirty, foul-tasting water but no warnings were given to the public on the night of the incident on 6 July, 1988.
Local residents subsequently reported suffering health problems, including stomach cramps, rashes, diarrhoea, mouth ulcers, aching joints and some even said their hair had turned green from copper residues.
This incident happened in July 1988, but is in the news again because of an inquest into the death of women in 2004 that may have been linked to the contamination of drinking water with aluminium sulphate. The incident is often mentioned when talking about human error, but details have not been available before.
The incident occurred when concentrated aluminium sulphate was transferred to the wrong tank at the Lowermoor plant, which supplied a large area of north Cornwall including Camelford. This meant it was present in the drinking water at a much higher concentration than it should have been.
The driver of the delivery tanker told the inquest how he had stepped in at the last minute to take over the delivery. He was told to put his load "in a tank on the left", but he was confused because there were several tanks and manhole covers.
He said he had asked his colleagues to telephone the authority to say he would be running late but when he arrived at Lowermoor no one was there. He said there was no phone available to ring anyone.
According to the The BBC on 1 November 2010 the driver told the inquest he had let himself into the works with a key given to him by the regular driver Barry Davey. But he did not know the former South West Water Authority, which ran the works, used the same key at all its plants. He had believed the key would let him into the site and open one tank.
In another article from The BBC on 1 November 2010, The chemical was used to treat cloudy water. As well as being too concentrated in the drinking water supply, the acidity in the water also released chemicals in pipe networks into people's homes.
The water company was inundated with around 900 complaints about dirty, foul-tasting water but no warnings were given to the public on the night of the incident on 6 July, 1988.
Local residents subsequently reported suffering health problems, including stomach cramps, rashes, diarrhoea, mouth ulcers, aching joints and some even said their hair had turned green from copper residues.
Friday, October 15, 2010
Common Sense Common Safety
Report by Lord Young of Graffham to the Prime Minister published 15 October 2010 and available from the Number 10 website
Lord Young was given the job of reviewing the operation of health and safety laws and the growth of the compensation culture. The main concern being that the standing of health and safety has in the eyes of the public has dramatically reduced.
According to the report, over 800,000 compensation claims were made in the UK during 2009. Some of these were for trivial matters, and the rise of claims management companies seems to have been a driving factor. The problem is that companies, voluntary organisations, schools, emergency services and others are becoming overly risk-adverse and bureaucratic because of their fear of compensation.
There are quite a number of recommendations, but taken as a whole they cover:
* Reviewing the way that compensation claims can be made, including the role of companies that assist in these claims, to get society to move away from a compensation culture;
* Making sure well-intentioned volunteers (i.e. good Samaritans) are not held liable for consequences that may arise;
* Simplify compliance processes for low-hazard workplaces, and provide more help so that organisations can easily check and record their compliance;
* Implement an accreditation scheme for health and safety consultants with the aim of improving professionalism and raising standards;
* Encouraging insurance companies to take a more reasonable approach to minimise the burden on their customers;
* Simplifying processes for schools;
* Provide a means for citizens to challenge local authorities if they want to ban events on health and safety grounds.
The report suggests some aspects of health and safety legislation should be reviewed, but does not appear to advocate significant change. It is the application that is of most concern.
One suggestion that I think is particularly power is the suggestion to "Shift from a system of risk assessment to a system of risk–benefit assessment." Although I am disappointed that this is only directed towards Education establishments, and not for every organisation. I think this fundamental shift could significantly improve the way risks are managed in practice.
Lord Young was given the job of reviewing the operation of health and safety laws and the growth of the compensation culture. The main concern being that the standing of health and safety has in the eyes of the public has dramatically reduced.
According to the report, over 800,000 compensation claims were made in the UK during 2009. Some of these were for trivial matters, and the rise of claims management companies seems to have been a driving factor. The problem is that companies, voluntary organisations, schools, emergency services and others are becoming overly risk-adverse and bureaucratic because of their fear of compensation.
There are quite a number of recommendations, but taken as a whole they cover:
* Reviewing the way that compensation claims can be made, including the role of companies that assist in these claims, to get society to move away from a compensation culture;
* Making sure well-intentioned volunteers (i.e. good Samaritans) are not held liable for consequences that may arise;
* Simplify compliance processes for low-hazard workplaces, and provide more help so that organisations can easily check and record their compliance;
* Implement an accreditation scheme for health and safety consultants with the aim of improving professionalism and raising standards;
* Encouraging insurance companies to take a more reasonable approach to minimise the burden on their customers;
* Simplifying processes for schools;
* Provide a means for citizens to challenge local authorities if they want to ban events on health and safety grounds.
The report suggests some aspects of health and safety legislation should be reviewed, but does not appear to advocate significant change. It is the application that is of most concern.
One suggestion that I think is particularly power is the suggestion to "Shift from a system of risk assessment to a system of risk–benefit assessment." Although I am disappointed that this is only directed towards Education establishments, and not for every organisation. I think this fundamental shift could significantly improve the way risks are managed in practice.
Wednesday, October 13, 2010
Similar to Snail Mail
Article at the Daily WTF (curious perversions in Information Technology) by Remy Porter on 20 July 2010.
A story relating to a company that sells addresses for use with direct marketing (junk mail). Maintaining lists of addresses is relatively easy, but to have names of residents at those addresses requires more work to acquire and update. Therefore, it is cheaper to use a generic name such as "The resident" or "The car owner." Apparently these generic terms are known as "slug names."
The company in question provided a web based service whereby the direct marketers could go online and download the address lists for a fee. They updated the service so that the customer could choose the cheaper, unnamed list.
The code used by the website checked whether the 'Slug' option was selected, and knew to not include names. However, an oversight meant that an alternative to the name was not supplied, and instead it was labelled "slug." This meant, when mail was sent it was addressed "To the Slug." This was only discovered after several mailings had been sent out.
The underlying cause of this error was in the specification for the code. It simply required the option to be provided to the customer, and did not same anything about how that was to be handled. The code went through full quality assurance, but this simply checked against the original specification.
A story relating to a company that sells addresses for use with direct marketing (junk mail). Maintaining lists of addresses is relatively easy, but to have names of residents at those addresses requires more work to acquire and update. Therefore, it is cheaper to use a generic name such as "The resident" or "The car owner." Apparently these generic terms are known as "slug names."
The company in question provided a web based service whereby the direct marketers could go online and download the address lists for a fee. They updated the service so that the customer could choose the cheaper, unnamed list.
The code used by the website checked whether the 'Slug' option was selected, and knew to not include names. However, an oversight meant that an alternative to the name was not supplied, and instead it was labelled "slug." This meant, when mail was sent it was addressed "To the Slug." This was only discovered after several mailings had been sent out.
The underlying cause of this error was in the specification for the code. It simply required the option to be provided to the customer, and did not same anything about how that was to be handled. The code went through full quality assurance, but this simply checked against the original specification.
Family's Titanic secret revealed
BBC Website 22 September 2010
According to new information from novelist Louise Patten, granddaughter of Titanic's Second Officer Charles Lightoller, the ship hit the iceberg because the helmsman turned the wrong way when ordered to change direction.
The explanation of why such a fundamental error occurred is that the accident happened at a time when ship communications were in transition from sail to steam. Two different systems were in operation at the time, Rudder Orders (used for steam ships) and Tiller Orders (used for sailing ships). Crucially, Mrs Patten said, the two steering systems were the complete opposite of one another, so a command to turn 'hard a-starboard' meant turn the wheel right under one system and left under the other."
It just so happens that the helmsman had been trained on sail, but was steering a steam vessel.
Mrs Patten claims that only a very small number of people knew about this mistake, but they kept quiet because if the White Star Line had been found to be negligent, it would have gone bankrupt and everyone would have lost their jobs.
According to new information from novelist Louise Patten, granddaughter of Titanic's Second Officer Charles Lightoller, the ship hit the iceberg because the helmsman turned the wrong way when ordered to change direction.
The explanation of why such a fundamental error occurred is that the accident happened at a time when ship communications were in transition from sail to steam. Two different systems were in operation at the time, Rudder Orders (used for steam ships) and Tiller Orders (used for sailing ships). Crucially, Mrs Patten said, the two steering systems were the complete opposite of one another, so a command to turn 'hard a-starboard' meant turn the wheel right under one system and left under the other."
It just so happens that the helmsman had been trained on sail, but was steering a steam vessel.
Mrs Patten claims that only a very small number of people knew about this mistake, but they kept quiet because if the White Star Line had been found to be negligent, it would have gone bankrupt and everyone would have lost their jobs.
Tuesday, October 12, 2010
A manager's guide to reducing human error
Publication 770 from the American Petroleum Institute (API). Full title 'A manager's guide to reducing human errors. Improving human performance in the process industries.' Published March 2001 and written by D.K. Lorenzo
9 years since publication, it is easy to think that things have moved on and this may be somewhat out of date. However, I don't think this is the case. I particularly like section 3.1 which lists "examples of error likely situations." They include:
1. Deficient procedures - good procedures help ensure qualified people can operate correctly and safely
2. Inadequate, inoperative or misleading instrumentation - poor instrumentation means workers have to 'fill in the blanks' by deduction and inference when working out what is going in on
3. Insufficient knowledge - not just knowing the 'what' and 'how;' but also the 'why'
4. Conflicting priorities - particularly between production (which usually has more tangible rewards) and safety
5. Inadequate labelling - useful for new workers, workers who only use the system infrequently or frequent users when in stressful situations
6. Inadequate feedback - if feedback on actions is not prompt, people tend to over-react
7. Policy/practice discrepancies - once any discrepancy is tolerated between what is written and what happens in practice, the workers will use their own judgement to decide which policies are to be applied
8. Disabled equipment - either means workers are not aware of what is happening or are distracted by spurious alarms and trips
9. Poor communication - two way verbal communications to confirm understanding, backed up by written where it is critical
10. Poor layout - if an instrument, control or other item is not located conveniently, it is unlikely to be used as intended or required
11. Violations of populational stereo types - the way people will respond without thinking because of what they are used to in everyday life
12. Overly sensitive controls - people are not very precise and so controls have to be designed with that in mind
13. Excessive mental tasks - the more demanding, the greater chance of error
14. Opportunities for error - if there is the chance for error, even if likelihood is considered low, it will eventually occur
15. Inadequate tools - proper tools expand human capabilities and reduce the likelihood of error
16. Sloppy housekeeping - appearance of a facility is usually perceived as a reflection of management's general attitude.
17. Extended, uneventful vigilance - if people need to monitor something for some time (more than 30 minuets) when nothing is happening, their ability to detect something becomes very low
18. Computer control failure - computers prone to errors in software and operator input, and so whilst having the potential to improve efficiency, safety etc. the risks need to be understood and managed properly
19. Inadequate physical restriction - as long as it does not impede normal operations, interlocks, unique connections and other physical characteristics can reduce error likelihood
20. Appearance at the expense of functionality - during design it is easy to concentrate on aesthetic factors such as consistency and order; whereas how the person will use the system is actually most important.
I believe the publication is still available from the API website
9 years since publication, it is easy to think that things have moved on and this may be somewhat out of date. However, I don't think this is the case. I particularly like section 3.1 which lists "examples of error likely situations." They include:
1. Deficient procedures - good procedures help ensure qualified people can operate correctly and safely
2. Inadequate, inoperative or misleading instrumentation - poor instrumentation means workers have to 'fill in the blanks' by deduction and inference when working out what is going in on
3. Insufficient knowledge - not just knowing the 'what' and 'how;' but also the 'why'
4. Conflicting priorities - particularly between production (which usually has more tangible rewards) and safety
5. Inadequate labelling - useful for new workers, workers who only use the system infrequently or frequent users when in stressful situations
6. Inadequate feedback - if feedback on actions is not prompt, people tend to over-react
7. Policy/practice discrepancies - once any discrepancy is tolerated between what is written and what happens in practice, the workers will use their own judgement to decide which policies are to be applied
8. Disabled equipment - either means workers are not aware of what is happening or are distracted by spurious alarms and trips
9. Poor communication - two way verbal communications to confirm understanding, backed up by written where it is critical
10. Poor layout - if an instrument, control or other item is not located conveniently, it is unlikely to be used as intended or required
11. Violations of populational stereo types - the way people will respond without thinking because of what they are used to in everyday life
12. Overly sensitive controls - people are not very precise and so controls have to be designed with that in mind
13. Excessive mental tasks - the more demanding, the greater chance of error
14. Opportunities for error - if there is the chance for error, even if likelihood is considered low, it will eventually occur
15. Inadequate tools - proper tools expand human capabilities and reduce the likelihood of error
16. Sloppy housekeeping - appearance of a facility is usually perceived as a reflection of management's general attitude.
17. Extended, uneventful vigilance - if people need to monitor something for some time (more than 30 minuets) when nothing is happening, their ability to detect something becomes very low
18. Computer control failure - computers prone to errors in software and operator input, and so whilst having the potential to improve efficiency, safety etc. the risks need to be understood and managed properly
19. Inadequate physical restriction - as long as it does not impede normal operations, interlocks, unique connections and other physical characteristics can reduce error likelihood
20. Appearance at the expense of functionality - during design it is easy to concentrate on aesthetic factors such as consistency and order; whereas how the person will use the system is actually most important.
I believe the publication is still available from the API website
Wednesday, September 22, 2010
Fight - Move - Float
At a recent task analysis workshop I was running one of the process operators, who was ex-navy, told me that warships have three modes of operation. They are Fight, Move and Float.
It occurs to me that there may be a case to identify explicit modes of operation at industrial facilities. I'm blogging this now as a prompt for me to give it some thought.
I've had a quick google and only found a couple of references to this philosophy.
The Australian Navy's Semaphore Issue 10, August 2008 says these modes are fundamental in the design of warships.
Parliamentary Candidate Richard Mollet refers to it in his blog saying that the Navy use it to decide command priorities.
According to Wikipedia page for Canadian Navy mottos "Innare Progredi Bellare" is Latin for To Float, to Move, to Fight
It occurs to me that there may be a case to identify explicit modes of operation at industrial facilities. I'm blogging this now as a prompt for me to give it some thought.
I've had a quick google and only found a couple of references to this philosophy.
The Australian Navy's Semaphore Issue 10, August 2008 says these modes are fundamental in the design of warships.
Parliamentary Candidate Richard Mollet refers to it in his blog saying that the Navy use it to decide command priorities.
According to Wikipedia page for Canadian Navy mottos "Innare Progredi Bellare" is Latin for To Float, to Move, to Fight
Wednesday, September 15, 2010
World Cup TV gaffe 'caused by human error'
According to the BBC Website on 23 August 2010
An "unfortunate error" in a control centre led to ITV HD viewers seeing a car advert instead Steven Gerrard's goal four minutes into the England v USA match on 12 June.
ITV stated that it took additional measures after the incident to ensure it could not happen again, including manufacturing special covers to avoid accidental activation of equipment.
An "unfortunate error" in a control centre led to ITV HD viewers seeing a car advert instead Steven Gerrard's goal four minutes into the England v USA match on 12 June.
ITV stated that it took additional measures after the incident to ensure it could not happen again, including manufacturing special covers to avoid accidental activation of equipment.
BA passengers told in error of imminent crash
Article in The Independent by James Corcut 28 August 2010
Passengers on a British Airways flight were told they were about to crash into the sea after the message "This is an emergency. We may shortly need to make an emergency landing on water" was played in error.
BA said it was investigating the incident but denied reports that the message was triggered in error by one of the pilots. A spokesman added: "We would like to apologise to passengers."
If it was not pilot error, I wonder what caused it. If it was computer error, that seems more worrying.
Passengers on a British Airways flight were told they were about to crash into the sea after the message "This is an emergency. We may shortly need to make an emergency landing on water" was played in error.
BA said it was investigating the incident but denied reports that the message was triggered in error by one of the pilots. A spokesman added: "We would like to apologise to passengers."
If it was not pilot error, I wonder what caused it. If it was computer error, that seems more worrying.
Simulator training flaws tied to airline crashes
Article in USA Today by Alan Levin 31 August 2010
According to the paper's analysis, "Flaws in flight simulator training helped trigger some of the worst airline accidents in the past decade. More than half of the 522 fatalities in U.S. airline accidents since 2000 have been linked to problems with simulators".
One problem is that in rare but critical instances simulators can trick pilots into habits that lead to catastrophic mistakes. For example, many simulators make difficult take offs, such as in gusty cross-winds, seem far easier than in the real world. But people may not be told told that simulators are inaccurate.
According to Kevin Darcy, an aviation safety consultant "It's really important to know how that data is programmed and where the holes are. Otherwise you are fooling yourself."
Simulators are only as good as the data used to program them. Current simulators aren't accurate when a plane goes out of control, which has prevented their use in training for the leading killer in commercial aviation.
Simulator training was cited in some of the deadliest accidents in the past decade. Among them:
• After a Colgan Air plane went out of control and 50 people died near Buffalo on Feb. 12, 2009, the NTSB found that airline simulators needed to be improved to give pilots better training in such emergencies.
• On Nov. 12, 2001, an American Airlines pilot's aggressive use of the rudder caused his jet to break apart, killing 265 people. The NTSB found that a American simulator exercise had given pilots a false sense of how the rudders worked.
According to the paper's analysis, "Flaws in flight simulator training helped trigger some of the worst airline accidents in the past decade. More than half of the 522 fatalities in U.S. airline accidents since 2000 have been linked to problems with simulators".
One problem is that in rare but critical instances simulators can trick pilots into habits that lead to catastrophic mistakes. For example, many simulators make difficult take offs, such as in gusty cross-winds, seem far easier than in the real world. But people may not be told told that simulators are inaccurate.
According to Kevin Darcy, an aviation safety consultant "It's really important to know how that data is programmed and where the holes are. Otherwise you are fooling yourself."
Simulators are only as good as the data used to program them. Current simulators aren't accurate when a plane goes out of control, which has prevented their use in training for the leading killer in commercial aviation.
Simulator training was cited in some of the deadliest accidents in the past decade. Among them:
• After a Colgan Air plane went out of control and 50 people died near Buffalo on Feb. 12, 2009, the NTSB found that airline simulators needed to be improved to give pilots better training in such emergencies.
• On Nov. 12, 2001, an American Airlines pilot's aggressive use of the rudder caused his jet to break apart, killing 265 people. The NTSB found that a American simulator exercise had given pilots a false sense of how the rudders worked.
Friday, September 10, 2010
Deepwater Horizon - The Human Factors
I've had a quick look at the Accident Investigation Report published 8 September 2010 available from the BP website. There a number of human factors issues raised that are not new discoveries in the world of process safety, but this does re-emphasise their importance.
I've provided more information below, but the main human factors issues uncovered include:
* Personnel reassured by initial test results so that they did not complete the subsequent test steps that may have shown they had a problem;
* Personnel developing theories that explained what was being observed was acceptable and not a problem;
* Failure to provide detailed procedures for critical tasks, and relying on competence without any assurance that competence was in place;
* Failure to define what level of monitoring is required during critical activities, leaving it to the individual's discretion;
* Personnel undertaking critical tasks being distracted by other activities;
* Not preparing personnel (through training, exercises, instructions) to deal with problems so that they do not know what to do to avoid knock-on effects and escalation.
Recommendations made in the report cover:
* Clarifying practices and procedures for critical activities
* Improve incident reporting, investigation and close out of the resulting actions;
* Improve risk management and management of change (MOC) processes
* Enhance competency programs
* Establish BP’s in-house expertise in activities performed by contractors.
For further information see below.
Key Finding 1 of the report is that the annulus cement barrier did not isolate the hydrocarbons. It is clear that the cement requirements were complex. A simulation was run to establish an acceptable slurry design and placement. Some tests were run and passed, but the report suggests that they were not comprehensive. It appears to me that the team were happy with the initial test results, and so did not see the need to do more. This is fairly standard human behaviour. We are usually reassured if everything seems to be OK, and not inclined to look further in case something is wrong. One factors identified in High Reliability Organisations that set them apart from others is that they are NOT easily reassured that things are OK, and always assume something must be wrong somewhere, and continually search for problems.
Key-finding 3 of the report is that the negative-pressure test was accepted although well integrity had not been established. It is clear that the test was carried out, which involves reducing wellbore pressure below reservoir pressure to check that mechanical barriers were able to prevent hydrocarbons getting where should not. The report says that the initial findings from the test were not as expected, with 15 barrels of fluid flowing whereas less than 4 would have been considered normal. But further testing seemed to suggest that there was not a serious problem, and a theory of 'annular compression' or 'bladder effect' was used to explain the initial observations. However, there were other possible reasons for what happened, including plugging with solids or human error. Again, it is normal human behaviour to believe the information that tells us what we want or expect to see (i.e. in this case the test being passed) whilst ignoring other information or observations that may be indicating something is wrong or not as expected.
Another aspect of key findings 3 was that a detailed procedure was not provided, even though the negative-pressure test was a critical activity. I don't know if it is the case here, but most companies have many procedures, often with lots of detail. But they rarely concentrate on making sure they have the procedures they really need. In reality we need detailed procedures for the most critical tasks, and it is vital that they are actually used. For lower criticality tasks we can rely on competence, providing we have some way of ensuring that competence has been established. The reality for many companies is that the procedures are rarely used and competence is relied on for high and low criticality tasks, with poor systems in place to manage competence.
Key Finding 4 of the report was that the influx of hydrocarbons was not recognised soon enough to rectify the problem. Instructions were in place stating that "the well was to be monitored at all times." It is very common to write in a procedure or instruction that a system or item of equipment has to be monitored. But unless it says how the monitoring has to be carried out, what conditions need to be achieved or what needs to be done in response to events, these instructions are almost worthless. This seems to have been the case in this incident as the evidence suggests that the indications of a problem were not picked up for over 40 minutes. As well as lack of clarity in the instruction to monitor, the crew were probably distracted by a number of other activities taking place at the time.
Key finding 5 of the report was that well control response actions failed to regain control of the well. It is suggested that the protocols in place did not "fully address how to respond to high flow emergency situations" and that the crew were not sufficiently prepared. Again this is a common weakness. Company procedure and competency systems are often best at addressing routine activities and obvious emergencies (i.e. fire, toxic release) but do little to prepare people for unplanned events that can have serious knock-on effects if not recognised or dealt with properly. Although exercises to test muster and evacuation may be carried out regularly, personnel are rarely put through their paces on how to deal with major process upsets, trips, loss of utilities etc.
Recommendations from the report that relate to human factors most closely include:
* Update and clarify current practices to ensure that a clear and comprehensive set
of cementing guidelines and associated Engineering Technical Practices (ETPs) are
available as controlled standards. The practices should include, as a minimum:
- Clearly defined mandatory practices.
- Recommended practices and operational guidance.
- Definitions of critical cement jobs.
- Description of the technical authority’s (TA’s) role in oversight and decision making.
* Clarify and strengthen standards for well control and well integrity incident reporting and investigation. Ensure that all incidents are rigorously investigated and that close out of corrective actions are completed effectively.
* Review and assess the consistency, rigor and effectiveness of the current risk management and management of change (MOC) processes practiced by Drilling and Completions (D&C)
* Enhance D&C competency programs to deepen the capabilities of personnel in key operational and leadership positions and augment existing knowledge and proficiency in managing deepwater drilling and wells operations by:
- Defining the key roles to be included in the enhanced competency programs.
- Defining critical leadership and technical competencies.
- Creating a ‘Deepwater Drilling Leadership Development Program.’ The program would build proficiency and deepen capabilities through advanced training and the practical application of skills.
- Developing a certification process to assure and maintain proficiency.
- Conduct periodic assessments of competency that include testing of knowledge and demonstrations of the practical application of skills.
* Develop an advanced deepwater well control training program that supplements current industry and regulatory training. Training outcomes would be the development of greater response capability and a deeper understanding of the unique well control conditions that exist in deepwater drilling. This program should:
- Embed lessons learned from Deepwater Horizon accident.
- Require mandatory attendance and successful completion of the program for all BP and drilling contractor staff who are directly involved in deepwater operations, specifically supervisory and engineering staff, both onshore and offshore.
- Where appropriate, seek opportunities to engage the broader drilling industry to widen and share learning.
* Establish BP’s in-house expertise in the areas of subsea BOPs and BOP control systems through the creation of a central expert team, including a defined segment engineering technical authority (SETA) role to provide independent assurance of the integrity of drilling contractors’ BOPs and BOP control systems. A formalized set of authorities and accountabilities for the SETA role should be defined.
I've provided more information below, but the main human factors issues uncovered include:
* Personnel reassured by initial test results so that they did not complete the subsequent test steps that may have shown they had a problem;
* Personnel developing theories that explained what was being observed was acceptable and not a problem;
* Failure to provide detailed procedures for critical tasks, and relying on competence without any assurance that competence was in place;
* Failure to define what level of monitoring is required during critical activities, leaving it to the individual's discretion;
* Personnel undertaking critical tasks being distracted by other activities;
* Not preparing personnel (through training, exercises, instructions) to deal with problems so that they do not know what to do to avoid knock-on effects and escalation.
Recommendations made in the report cover:
* Clarifying practices and procedures for critical activities
* Improve incident reporting, investigation and close out of the resulting actions;
* Improve risk management and management of change (MOC) processes
* Enhance competency programs
* Establish BP’s in-house expertise in activities performed by contractors.
For further information see below.
Key Finding 1 of the report is that the annulus cement barrier did not isolate the hydrocarbons. It is clear that the cement requirements were complex. A simulation was run to establish an acceptable slurry design and placement. Some tests were run and passed, but the report suggests that they were not comprehensive. It appears to me that the team were happy with the initial test results, and so did not see the need to do more. This is fairly standard human behaviour. We are usually reassured if everything seems to be OK, and not inclined to look further in case something is wrong. One factors identified in High Reliability Organisations that set them apart from others is that they are NOT easily reassured that things are OK, and always assume something must be wrong somewhere, and continually search for problems.
Key-finding 3 of the report is that the negative-pressure test was accepted although well integrity had not been established. It is clear that the test was carried out, which involves reducing wellbore pressure below reservoir pressure to check that mechanical barriers were able to prevent hydrocarbons getting where should not. The report says that the initial findings from the test were not as expected, with 15 barrels of fluid flowing whereas less than 4 would have been considered normal. But further testing seemed to suggest that there was not a serious problem, and a theory of 'annular compression' or 'bladder effect' was used to explain the initial observations. However, there were other possible reasons for what happened, including plugging with solids or human error. Again, it is normal human behaviour to believe the information that tells us what we want or expect to see (i.e. in this case the test being passed) whilst ignoring other information or observations that may be indicating something is wrong or not as expected.
Another aspect of key findings 3 was that a detailed procedure was not provided, even though the negative-pressure test was a critical activity. I don't know if it is the case here, but most companies have many procedures, often with lots of detail. But they rarely concentrate on making sure they have the procedures they really need. In reality we need detailed procedures for the most critical tasks, and it is vital that they are actually used. For lower criticality tasks we can rely on competence, providing we have some way of ensuring that competence has been established. The reality for many companies is that the procedures are rarely used and competence is relied on for high and low criticality tasks, with poor systems in place to manage competence.
Key Finding 4 of the report was that the influx of hydrocarbons was not recognised soon enough to rectify the problem. Instructions were in place stating that "the well was to be monitored at all times." It is very common to write in a procedure or instruction that a system or item of equipment has to be monitored. But unless it says how the monitoring has to be carried out, what conditions need to be achieved or what needs to be done in response to events, these instructions are almost worthless. This seems to have been the case in this incident as the evidence suggests that the indications of a problem were not picked up for over 40 minutes. As well as lack of clarity in the instruction to monitor, the crew were probably distracted by a number of other activities taking place at the time.
Key finding 5 of the report was that well control response actions failed to regain control of the well. It is suggested that the protocols in place did not "fully address how to respond to high flow emergency situations" and that the crew were not sufficiently prepared. Again this is a common weakness. Company procedure and competency systems are often best at addressing routine activities and obvious emergencies (i.e. fire, toxic release) but do little to prepare people for unplanned events that can have serious knock-on effects if not recognised or dealt with properly. Although exercises to test muster and evacuation may be carried out regularly, personnel are rarely put through their paces on how to deal with major process upsets, trips, loss of utilities etc.
Recommendations from the report that relate to human factors most closely include:
* Update and clarify current practices to ensure that a clear and comprehensive set
of cementing guidelines and associated Engineering Technical Practices (ETPs) are
available as controlled standards. The practices should include, as a minimum:
- Clearly defined mandatory practices.
- Recommended practices and operational guidance.
- Definitions of critical cement jobs.
- Description of the technical authority’s (TA’s) role in oversight and decision making.
* Clarify and strengthen standards for well control and well integrity incident reporting and investigation. Ensure that all incidents are rigorously investigated and that close out of corrective actions are completed effectively.
* Review and assess the consistency, rigor and effectiveness of the current risk management and management of change (MOC) processes practiced by Drilling and Completions (D&C)
* Enhance D&C competency programs to deepen the capabilities of personnel in key operational and leadership positions and augment existing knowledge and proficiency in managing deepwater drilling and wells operations by:
- Defining the key roles to be included in the enhanced competency programs.
- Defining critical leadership and technical competencies.
- Creating a ‘Deepwater Drilling Leadership Development Program.’ The program would build proficiency and deepen capabilities through advanced training and the practical application of skills.
- Developing a certification process to assure and maintain proficiency.
- Conduct periodic assessments of competency that include testing of knowledge and demonstrations of the practical application of skills.
* Develop an advanced deepwater well control training program that supplements current industry and regulatory training. Training outcomes would be the development of greater response capability and a deeper understanding of the unique well control conditions that exist in deepwater drilling. This program should:
- Embed lessons learned from Deepwater Horizon accident.
- Require mandatory attendance and successful completion of the program for all BP and drilling contractor staff who are directly involved in deepwater operations, specifically supervisory and engineering staff, both onshore and offshore.
- Where appropriate, seek opportunities to engage the broader drilling industry to widen and share learning.
* Establish BP’s in-house expertise in the areas of subsea BOPs and BOP control systems through the creation of a central expert team, including a defined segment engineering technical authority (SETA) role to provide independent assurance of the integrity of drilling contractors’ BOPs and BOP control systems. A formalized set of authorities and accountabilities for the SETA role should be defined.
Subscribe to:
Posts (Atom)