Effective system safety and emergency management efforts require learning from failure, and from success. Lessons learned will be presented here, often illustrated through an accident or incident. Note that in discussing these events, the intent is not to oversimplify the conditions that led to the incidents or to place blame on individuals and organizations. Rarely is there only one identifiable cause leading to the accident. Accidents and incidents are usually the result of complex factors that include hardware, software, human interactions, procedures, and organizational influences. Readers are encouraged to review the full investigation reports referenced to understand the often complex conditions that led to each accident discussed here.
Fire on Carrier Vessel in Australia
On February 16, 2010, the bulk carrier River Embley experienced a fire while anchored off Gladstone, Queensland in Australia. A short time after the crew discovered the fire there was an explosion in the engine room. The crew shut down the engines and transferred power to the emergency generators following the explosion. After the crew assessed the situation, two crew members entered the engine room while wearing breathing apparatus and reported a small fire when they returned. Crew members were then able to extinguish the fire using a portable fire extinguisher. Two crew members suffered minor injuries in the incident. The Australian Transport Safety Bureau found in its investigation that the fire was the result of a failure in a thermostatic valve in the air compressor. As a result of the valve failure the compressor oil temperature increased until it reached its flashpoint. Oil vapor was expelled into the engine room from a temperature and pressure buildup inside the engine separator, eventually resulting in the explosion. The investigation report commended the actions of the crew. The crew followed procedure following the emergency, and they first gathered personnel to assure that all were accounted for. The crew then investigated the fire and took appropriate action. As stated in the report, “[The crew members] understood their roles and responsibilities, worked as a team and appropriately considered the evidence at hand when planning their response… Together, the master and crew demonstrated how effective a trained response to an unexpected emergency can be.”
Lessons Learned: While system safety tries to build in safety, the discipline recognizes that in spite of our best efforts there will be ways that things go wrong because of many different factors, some beyond an organization's control. Therefore, system safety not only tries to prevent an accident but also tries to find ways to prevent a bad situation from becoming worse and recover once an event has occurred. This requires planning not only for a system safety effort but also emergency planning to prepare for unexpected events. In strong safety management and engineering efforts, system safety and emergency management disciplines and personnel are integrated to assure continuity of operations after a major mishap or in the presence of continuous stress.
Australian Transport Safety Bureau, “Independent investigation into the engine room fire on board the Australian registered bulk carrier River Embley off Gladstone, Queensland, 16 February 2010,” Marine Occurrence Investigation No. 272, MO-2010-00, 2011.
Explosions and Fires in Georgia
On April 10, 1995, a series of explosions occurred at the Powell Duffryn Terminals, Inc. chemical storage and transfer facility in Savannah, Georgia. An office building was destroyed by the resulting fire, and it took firefighters three days to extinguish the fire. In addition, residents had to be evacuated from the initial explosion and then again when chemicals leaking from storage tanks reacted with other chemicals in the area and produced hydrogen sulfide gas. Contaminated water from the firefighting effort flowed into an adjacent marsh, resulting in the deaths of a large number of fish. The U.S. Environmental Protection Agency (EPA) found in its investigation that crude sulfate turpentine (CST) vapors had been diverted to activated carbon drums during a planned contract maintenance effort. The temperature of the activated carbon may have risen above the autoignition temperature of CST, and atmospheric air provided oxygen needed to trigger a fire. Once the fire started it spread through vent piping to other chemicals, triggering explosions and a larger fire. The EPA stated that a root cause of the accident was that the vapor control system design was inadequate, and the system did not prevent the introduction of ambient air. However, the report also highlighted a number of contributing causes. Less than six months before the accident, the company had requested approval from the Chatham County Department of Inspections to store CST on-site. Prior to this time the company had only been allowed to store non-flammable liquids. The change in operation was approved, contingent on the company meeting certain safety requirements. However, the County and the Savannah Fire Department did not verify that the changes had been made. The company had planned to implement a foam fire suppression system as part of changes to accommodate the storage of flammable materials, but the company began storing such chemicals on site before that fire suppression system had been completed. The EPA also discovered that the CST storage tanks did not have flame arresters; the flame arresters may have prevented the spread of fire from the storage tanks through the PVC piping system and to other tanks. In addition, heat from the fire caused a concrete containment wall to be breached; the wall had not been modified to account for storage of flammables. The EPA also found that incompatible materials had been stored next to each other, leading to the production of hydrogen sulfide gas.
Lessons Learned: Engineering by its very nature is an activity that involves change. As systems are used in operation, the design and procedures often change, and the associated risks may increase. Changes could include modifications to equipment, procedures, raw materials, and processing conditions. Therefore, changes must be thoroughly evaluated through Management of Change policies, procedures, and analyses to assure that safety is maintained.
U.S. Environmental Protection Agency, “EPA Chemical Accident Investigation Report, Powell Duffryn Terminal, Inc., Savannah, Georgia,” EPA 550-R-98-003, May 1998.
Passenger Train System Close Call
On September 23, 2009, an overhead electrical line used to supply electrical power to the trains parted and fell onto the passenger platform at London’s St. Pancras International Station. The supply circuit breaker opened automatically, but then closed again twice automatically and then three other times by manual intervention by operations personnel. Each time the circuit was closed the passengers were exposed to a potentially lethal electrical hazard. Fortunately the line was eventually isolated and passengers were safely evacuated from the train and platform. The accident report found that the immediate cause of the wire parting was local overheating caused by high electrical current flowing through the wires. Cables had been incorrectly connected and configured, and continuity tests had not been conducted of the supply system protection equipment. In addition, the lines were not properly restrained, allowing them to fall onto the platform once they parted. Contributing to the hazard was that the circuit breakers were designed to re-close automatically after 6 seconds to provide recovery after transient faults (for example, by birds or rodents creating an electrical path to ground). This allowed a minimal disruption to service, but created potential safety issues. In addition, the operator did not follow procedure; he should have contacted a signaler before trying to close the circuit breaker. The recommendations included improvements in the design and test of electrical systems, improvements in quality management processes, additional operator training, and reconsideration of the use of circuit breakers with automatic resets.
Lessons Learned: Safety is only one of many tradeoffs made in the development of a system. Typically, safety, cost, schedule, technical capabilities, and (at times) political considerations all help determine an acceptable design. However, decisions made for production or contractual purposes, such as the decision to automatically re-close circuit breakers after a failure, must be carefully analyzed. This is why it is so important for safety to be part of the acquisition process and if possible be integrated with engineering on complex programs to assess such decisions.
Rail Accident Investigation Branch, Department of Transport (U.K.), “Overhead line failure, St Pancras International 23 September 2009, Rail Accident Report 12/2010, August 2010.