Ships in Service Training Material A-M CHAUVEL Case study Using ISM Code in an Investigation 2009...

Ships in Service Training Material A-M CHAUVEL

Case studyCase studyUsingUsing

ISM Code in anISM Code in anInvestigationInvestigation

2009

Accident Investigation

The purpose of an accident investigation is to take action to

prevent accidentsfrom recurring.

Examples ofspectacular

accidents

Piper Alpha, TWA andOcean Ranger





It is very important to find causes ofan accident in order to prevent bigger ones from taking place.

There are several examples of companies that have gone bankrupt as a consequence

of the physical damage resulting loss of production time after a major accident.

By going through the debris after an accident we can often find traces of

what caused the event.

THREE MILE ISLAND CASE

Nuclear contaminationThursday 28 may 1979

USA



Three Mile Island

A nuclear reactor at the Three Mile Island power plant near Harrisburg, Pa., suffers a partial core meltdown.

The FDA immediately began radiation sampling of milk, fish and water within a 20-mile radius of the facility.

FDA officials also arranged for the shipment of potassium iodide to protect citizens close to the plant had there been significant environmental leakage from the damaged reactor. The radiation that did escape from the facility was low enough that use of the protective drug was not needed, and no food or other products were contaminated.

March 28, 1979


There was nothing unusual about the early morning of March 28, 1979 at the Three Mile Nuclear Generating station. The weather was cold but not unusually so.

But during routine maintenance, an automatically operated valve in the Unit 2 reactor closed when it should not have most likely due to either a mechanical or electrical failure.

This shut off the water supply to the system that cools down the reactor core and prevented the steam generators from removing heat. Automated systems then shut down the reactor core. That should have been the end of the accident, but it was not.

The AccidentThree Mile Island


A misreading by one of the engineers on duty compounded with a series of equipment and instrument malfunctions led to a dangerous loss of water coolant from the reactor core.

As a result, the reactor core was partially exposed, which led to some radioactive gases escaping into the containment section of the reactor building.

Though some of this radiation was released into the surrounding area, no immediate deaths or injuries occurred.

The AccidentThree Mile Island

Control valve

- On- 0ff


When a small valve stuck open, cooling water escaped andthe reactor core of TMI's Unit 2 began to melt.

But at the time, nobody seemed to know what was going on.

Three Mile Island

Three Mile Island


EquipmentEquipment

Control room design errors

Error of comprehensionof the situation

NuclearNuclearplanplan

dismantleddismantled

PersonnelPersonnel

Lack of trainingIncorrect recognitionof the signal

Consignation error (signal )

Cooling pump failure

Steadiness in hisdecision

Three Mile Island


EquipmentEquipment

Control room design errors

Error of comprehensionof the situation

NuclearNuclearplanplan

dismantleddismantled

PersonnelPersonnel

Lack of training

Consignation error (signal )

Cooling pump failureCooling pump failure

Steadiness in hisdecision

6.5

10.3

10.3

Ergonomic

Human errorIncorrect recognition

of the signal


20 years later

Three Mile Island (After)In the following days

"If the operators had been asleep

that morningand not touched

anything,the accident would have

never happened.“

Harold Denton

FLAUJAC CASE

Collision of two trainsSaturday 3 august 1985

Paris - Rodez


A human error


15:4015:30 16:1015:5015:2015:10 16:00RocAmadour

Gramat

Flaujac

Assier

Fournel

Figeac

local trainRodez-Brive

7924

CorailParis-Rodez

6153 SA

29/06 to 07/09

7921 SF SA

6151 SA

Flaujac Accident (Theory situation)


15:4015:30 16:1015:5015:2015:10 16:00RocAmadour

Gramat

Flaujac

Assier

Fournel

Figeac

local trainRodez-Brive

7924

CorailParis-Rodez

Delay

6153 SA

29/06 to 07/09

7921 SF SA

6151 SA

Flaujac Accident (Actual situation)


Majors Causes

Flaujac Accident

- Train delay- No safety loops- Error of lecture- Diagram complexity- Information misunderstood- New job ( Stress )- Procedure not followed

Flaujac Accident


ManagementManagement

Train delay

MethodsMethods

Diagramcomplexity

Procedurenot followed

- 32 dead- 32 deadpersonspersons- 2 trains- 2 trains

destroyeddestroyed

New job( Stress )

PersonnelPersonnel

Informationmisunderstood

Error of lecture

EquipmentEquipment

No safety loops


Majors Causes

Flaujac Accident

As an investigator :

Could you related the majors factors to the

accident using a causes-effect diagram.

Flaujac Accident


New job( Stress )


MethodsMethods

EquipmentEquipment

No safety loopsTrains delayTrains delay

Diagramcomplexity


- 32 dead- 32 deadpersonspersons- 2 trains- 2 trains

destroyeddestroyed

PersonnelPersonnel

Informationmisunderstood

Error of lecture

6.3

6.4

6.4

6.4

6.5

8.3

Brazaville1989170 people died

Physical Evidence


TENERIFE CASE

Collision of two aeroplanesSunday 27 march 1977

Airport of Santa Cruz


Tenerife Accident


Chronology of the event

16h 59mn 10 s PAA fly enter on the run way to take off on the west departure way. KLM fly is on the taxiway just behind the PAA fly. 17h 02mn 08s PAA fly enter the west departure gate. KLM fly pass the junction point C3 of the departure gate.

17h 05mn 44s KLM fly is at the end of departure gate ready to take off and request the authorisation to take off from the control tower.17h 05mn 53s PAA pass the junction point C3. KLM received the authorisation to take off from the control tower.

Tenerife Accident



17h 06mn 09 s KLM announce to the control tower that it will take off.17h 06mn 19s PAA announce that he has not degage the departure gate. Immediately the control tower ask to KLM fly to stop the take off procedure until new information. KLM didn't ear the message. The control tower didn't ask confirmation of message. 17h 06mn 25s The control tower ask to PAA fly to inform them as soon as the departure gate will be free.17h 06mn 30s PAA fly confirm to the control tower the message received.

Tenerife Accident



17h 06mn 33s The KLM co-pilot who understand the message inform the pilot that “PAA didn’t leave the departure gate”. “Yes” affirm the pilot.17h 06mn 49s Collision occur near the junction point C4.

Tenerife Accident


KLMTake off

AuthorisationInterpretation

InadequateInadequatewordingwording

Impatience ofImpatience ofthe pilotthe pilot

PAA positionInterpretation

PAAnot visible

Heavy fogHeavy fog

Tower controlconversation not

taken in consideration

PilotPilotconcentrationconcentration

on delayon delay

HierarchicalHierarchicalweightweight

RadioRadioDoubt onDoubt onmessagemessage

Non insistenceon message

received

Stop ordernot followed

Non respectNon respectof feed backof feed backprocedureprocedure

ReactorsReactorsnoisesnoises

Tenerife Accident


PAAmoving

Didn’t takeexit N° 3

Interpretation ofthe tower message

Ambiguity ofAmbiguity ofthe messagethe message

Exit n°4Exit n°4more easymore easy

Used ofmain runway

HolidaysHolidaysperiodperiod

CommercialCommercialconstraintsconstraints

Traffic turnedto Santa Cruz

Taxiwayobstructed

Emergencyprocedure

BombBomb explosion atexplosion atLas PalmasLas Palmas

Tenerife Accident


Majors Causes- Political crisis- Abnormal traffic- Heavy fog- Taxiway obstructed- Hierarchical authority- Wrong ground exit- 2 radio channels out of order- Airport Lighting system failure- Flight delay- Change in procedure- Order misunderstood- Procedure not followed- Pilot overconfident




accident using a causes-effect diagram

and ISM Code.

Tenerife Accident Majors Causes

Tenerife Accident


Pilotoverconfident

ManagementManagement MethodsMethods

EquipmentEquipmentEnvironmentEnvironment

PoliticalPoliticalcrisiscrisis

2 radio channelsout of order

Taxiwayobstructed

FlightFlightdelaydelay

Change inprocedure


- 582 dead- 582 deadpersonspersons

- 2 Boeing- 2 Boeingdestroyeddestroyed

PersonnelPersonnel

Ordermisunderstood

Lightingsystem failureAbnormalAbnormal

traffictraffic

Hierarchicalauthority

Wrong Wrong ground exitground exit

Heavy fogHeavy fog

7.0

10.3

10.3

7.0

6.45.2

8.35.2

84 men died

on the Ocean Ranger off Newfoundland.

Located on the Hibernia field,315 kilometers southeast of

St. John's on the Grand Banks, the Ocean Ranger sank in the wild winter seas in one of Canada's

worst marine disasters.


Ocean Ranger Tragedy (1982)

- An entire roughneck (drilling) crew of four to five men had quit over an injury to an inexperienced fellow worker.

- Verbal abuse of the roughnecks by the driller was normal Ocean Drilling and Exploration Co procedure (The owner of the rig and in charge of its drilling crews). Verbal abuse was one of the causes of an accident in which a new worker on the drill floor lost two fingers when they were caught in an elevator.

- Supervisors on the Ranger and other offshore rigs seemed to be cooperative with federal inspectors, but that there was a widespread feeling among ordinary crew members that they should keep quiet about problems on their vessels. The crew often seem to feel, rightly or wrongly, that they will lose their jobs if they give information to inspectors.


Ocean RangerTestimony of the Government Inspector

If the Ocean Ranger workers had been unionized, they would have had an

effective health and safety committee that could have ensured

that they had soundhealth and safety

education and training.

If they had been unionized, they would not have been afraid to speak out

to a government inspector.


Ocean Ranger Conclusion from Government Inspectors

84 men died

They might be alive today if their concerns about safety had been acted upon.

http://www.wrecksite.eu/img/wrecks/ocean_ranger.gif

PIPER ALPHA

Destroyed by a fireWednesday 6 July 1988

North Sea


Piper Alpha

Piper Alpha was a large North Sea oil platform that started production in 1976.

It produced oil from 24 wells.

In its early life it had also produced gas from two wells.

It was connected by an oil pipeline to Flotta and by gas pipelines to two other installations.

What was Piper Alpha?

On 6 July 1988 there was a massive leakage of gas condensate which was ignited causing an explosion which led to large oil fires.

The heat ruptured the riser of a gas pipeline from another installation.

This produced a further massive explosion and fireball that engulfed the Piper Alpha platform.

All this took just 22 minutes.

The scale of the disaster was enormous. 167 people died, 62 people survived..

What happened ?

Piper Alpha

It is believed that the leak came from pipe work connected to a condensate pump. A safety valve had been removed from this pipe work for overhaul and maintenance.

The pump itself was undergoing maintenance work. When the pipe work from which the safety valve had been removed was pressurised at start-up, it is believed the leak occurred.

What caused the leak?

Piper Alpha

Pump A

Pump B

Supercharger


Piper Alpha Accident



3 July 6h 00The gas treatment operation is stop for a maintenance reason. 15h 30mnThe operation pass in operational mode n°1.

6 July The pump A start to knock. The chief engineer decide to make a revision, and switch to pump B.A work permit is issued signed by the head of production, the chief of safety and the shift supervisor.A copy of the work permit stay in the operating room.The electrical system is switch off, but the maintenance was not planned. Two sub-contracting technicians take this opportunity to make the maintenance operation on the security valve associate to the pump A.

Piper Alpha



6 July

A second work permit is issued according to the procedure.The valve is isolated by an operator.The technicians removed the valve and fix plugs on both side of the open canalisation. No obligation to test the water-tightness.The valve is bought to the maintenance shop, where the work is done.

When finish just before 6PM, the crane was not available.The reinstallation job was postponed to the next day.The procedure in that case was follow and a copy of the work permit signed by the head of production, them suspended by the safety department until next day (Why?).

This event should have been notified in the operating log book.

Piper Alpha



6 July

18h00Shift change.21h50Failure of Pump B.21h53The level of liquid in the pressure reducer increased, alarm signal start. 21h54Report in operating room “the pump B will not start”21h56A low gas alarm start in the sector of the centrifugal compressor area Modules C. Two of three compressors failed.21h57 A major gas alarm start in the sector of the centrifugal compressor.

Piper Alpha



6 July

21h58First explosion. Emergency activated in operating room. Smoke visible under the ceiling of the 68 floor.10 to 30 seconds after the first visible flames a second explosion happened.21h59Crude oil from the main pipe accede from the area of extraction. Major damages happened in the operating room and maintenance shop. Safety light in service failed.22h00Operating room notice a major drop of crude oil in the pipe. The fire safety system didn’t worked.Piper Alpha send “Mayday”

Piper Alpha



6 July

22h07The radio leave it job because of the high temperature.22h22Colossal explosion. The platform intruded by a fireball and sacked by a explosion show an inclination of 45°.23h00The surface of the sea is burning all around the platform.

7 July

01h00Piper Alpha collapsed.

Piper Alpha


Majors Causes

Piper Alpha

- Lack of qualified supervisors ( summer holidays )- Fire protection system failure- Safety design error Safety design error- Maintenance procedure inadequate- Lighting safety system failure- Routine- Communication failure between shifts- Fire protection system failure- Life boats unavailable- Non qualified assistants- Not regular operating procedure- Minimum manning requirements- Work permit procedure inadequate- Drills & exercises no formal practices


Majors Causes



accident using a causes-effect diagram

and ISM Code.

Piper Alpha

Piper Alpha


Drills & exercisesno formal practices


MethodsMethods

EquipmentEquipment

Fire protectionsystem failure

Work permitprocedure inadequate

Maintenance procedureinadequate

- 167 dead- 167 deadpersonspersons

- 1 platform- 1 platformdestroyeddestroyed

- environmental- environmentalpollutionpollution

PersonnelPersonnel

Communication failurebetween shifts

Light safetysystem failure

Lack of qualifiedsupervisors

( summer holidays )

Minimum manningMinimum manningrequirementsrequirements

Safety designSafety designerrorerror

RoutineRoutine

Life boatsunavailable

Non qualified Not regular operatingNot regular operatingprocedureprocedure

8.26.7 7.0

6.2

10.1

10.3

10.310.3

10.3

6.2

Chemical contaminationSunday 2 December 1984

INDIA

A-M CHAUVEL - BUREAU VERITAS DNS-DCO Ships in Service Training Material A-M CHAUVEL

Bhopal


Delhi

Bhopal

Bhopal

= Exothermic reaction Stainless steel

Chloroform( Water + MIC )

Bhopal : population 800 000 600 km from Delhi

Union Carbide : - Pesticides plan - 1000 workers including sub-contractors - Production : 1981 : 5200 tons 1982 : 2300 tons 1983 : 1650 tons - Turn over: 15 millions $ - Estimated loss of 4 millions $ per year.

The accident started in the stock area of the methyl isocyanate ( MIC ) That day the equipment N° 610 contained 41 tons of MIC

On the night of the 2-3 December 1984 water inadvertently entered the MIC storage tank, where over 40 metric tons of MIC were being stored.

The addition of water to the tank caused a runaway chemical reaction, resulting in a rapid rise in pressure and temperature.

The heat generated by the reaction, the presence of higher than normal concentrations of chloroform, and the presence of an iron catalyst , produced by the corrosion of the stainless steel tank wall, resulted in a reaction of such momentum, that gases formed could not be contained by safety systems.

Bhopal


As a result, MIC and other reaction products, in liquid and vapour form, escaped from the plant into the surrounding areas.

There was no warning for people surrounding the plant as the emergency sirens had been switched off.

The effect on the people living in the shanty settlements just over the fence was immediate and devastating.

Many died in their beds, others staggered from their homes, blinded and choking, to die in the street.

Many more died later after reaching hospitals and emergency aid centres.

Bhopal


The early acute effects were vomiting and burning sensations in the eyes, nose and throat, and most deaths have been attributed to respiratory failure.

For some, the toxic gas caused such massive internal secretions that their lungs became clogged with fluids, while for others, spasmodic constriction of the bronchial tubes led to suffocation.

It is been estimated that at least 3,000 people died as a result of this accident, while figures for the number of people injured currently range from 200,000 to 600,000 people, with an estimated 500,000 typically quoted.

The factory was closed down after the accident.

Bhopal


The immediate cause of the chemical reaction was the seepage of water (500 litres) into the MIC storage tank.

The results of this reaction were exacerbated by the failure of containment and safety measures and by a complete absence of community information and emergency procedures.

Bhopal


The Bhopal disaster was the result of a combination of:

legal, technological, organizational, and human errors.

The long term effects were made worse by the absence of systems to care for and compensate the victims. Furthermore, safety standards and maintenance procedures at the plant had been deteriorating and ignored for months.

A listing of the defects of the MIC unit runs as follows:

- Gauges measuring temperature and pressure in the various parts of the unit, including the crucial MIC storage tanks, were so notoriously unreliable that workers ignored early signs of trouble.- The refrigeration unit for keeping MIC at low temperatures (and therefore less likely to undergo overheating and expansion should a contaminant enter the tank) had been shut off for some time.- The gas scrubber, designed to neutralize any escaping MIC, had been shut off for maintenance.- Even had it been operative, post-disaster inquiries revealed, the maximum pressure it could handle was only one-quarter that which was actually reached in the accident.

Bhopal


- The flare tower, designed to burn off MIC escaping from the scrubber, was also turned off, waiting for replacement of a corroded piece of pipe.

- The tower, however, was inadequately designed for its task, as it was capable of handling only a quarter of the volume of gas released.

- The water curtain, designed to neutralize any remaining gas, was too short to reach the top of the flare tower, from where the MIC was billowing.

- The lack of effective warning systems; the alarm on the storage tank failed to signal the increase in temperature on the night of the disaster. MIC storage tank number 610 was filled beyond recommended capacity; and the storage tank which was supposed to be held in reserve for excess MIC already contained the MIC.

Bhopal


- Lack of qualified supervisors- Total lack of safety culture- Cut on maintenance programme- Under qualified subcontractors- No emergency plan- Reduction of quality control personnel- Safety rules violation- Budget restrictions- Lack of maintenance on safety equipment- Lack of training- Safety valve failure- No plug for isolation of the system- Lack of knowledge of the process

Bhopal


Majors Causes

- More than2 300 dead

Persons

- 170 000 contaminated

Persons

- Environmentalpollution

Bhopal


Consequences

Bhopal


Using ISM Code :

Could you identify some deviations from the requirements

Causes - Effect Diagram


Bhopal


Management Methods

Equipment

- more than2 300 dead

persons- 170 000

contaminatedpersons

- environmentalpollution

Personnel


Unqualified subcontractors Lack of maintenance

on safety equipment

Lack of knowlegeof the process

ManagementManagement MethodsMethods

EquipmentEquipment

No maintenanceprogramme

Total lack ofsafety culture

- more than- more than2 300 dead2 300 dead

personspersons- 170 000 - 170 000

contaminatedcontaminatedpersonspersons

- environmental- environmentalpollutionpollution

PersonnelPersonnel

Lack of qualifiedsupervisors

Lack of training

No plug for isolationof the system

No emergencyplan

Safety rulesviolation

No quality control

Budget restrictions

Safety valve failure

10.2

10.2 7.0

6.4

6.6

6.3

2.2 10.2

10.1

4.0

2.1

8.1

3.3

6.2

3.3

Bhopal


Kings Cross Fire (1987) 31 died


Other Accident Causation

- Discarded cigarette- Accumulation of rubbish- Poor housecleaning practice- Wooden escalator- Failure of fire fighting equipment- Lack of emergency training- Poor safety culture


Herald of Free Enterprise (1987) 189 diedOther Accident Causation

- Failure to close bow doors- No checking/reporting system- Commercial pressures- Internal friction- Disease of sloppiness

http://3.bp.blogspot.com/_1KnN9FmrJtk/SNcDDAphq4I/AAAAAAAAADU/_YiJc5-rPqA/s1600-h/herald2.jpg


Clapham Junction (1988) 35 died & 500 injuredOther Accident Causation

- Signal failure- Incorrect maintenance- Degradation of working practices- Training problems- Communication problems- Poor supervision- Excessive working hours- Failure to learn lessons


Most of theMost of themajor accidentsmajor accidentshave for originshave for origins

MisinterpretationMisinterpretationof a signalof a signal

Late decisionLate decisionError of diagnosisError of diagnosis

AmbiguousAmbiguouscommunicationcommunication

Non respect of a procedureNon respect of a procedureor regulationor regulation

Before StartingBefore StartingAN ACCIDENTAN ACCIDENT

INVESTIGATIONINVESTIGATIONIN SHIPPING INDUSTRYIN SHIPPING INDUSTRY


GroundingStranding (21%)

GroundingStranding (21%)

Foundered (44%)Foundered (44%)

Fire Explosion (16%)Fire Explosion (16%)

Shipslost

Shipslost

Contact (1%)Contact (1%)

Collision (12%)Collision (12%)

??Adverse weather

Adverse weather

High speedHigh speed

Technicalcircumstances

Technicalcircumstances

StressStress

Social hierarchy on board

Social hierarchy on board

SpeedSpeed

PracticesPractices

FatigueFatigue

Poorplanning

Poorplanning

Lack of attentionLack of

attention

Communication failures

Communication failures

Careless overconfidence

Careless overconfidence

Error of judgement

Error of judgement

Excessive speed

Excessive speed

Management deficiencies

Management deficiencies

TrainingTraining

Reductionof crew

Reductionof crew

Defective equipmentDefective

equipment

DesignDesign

Blind eyes to procedures

Blind eyes to procedures

A - M CHAUVEL - BUREAU VERITAS


Why do we need anindependent investigator ?

http://cosmicabyss.silent-echo.org/hello/273/951/1024/PC280047.jpg

Ghislengien BelgiumJuly 30 2004

LNGPipeline

Explosion

Explosion :16 dead

120 Injured

Bad condition

( meets Internationalstandards)

Quality controlprocedures

(Respected)

Pressuretoo high

(under thestandard)

Development of the industrial zone

Consolidation workof the underground

Flooded risk area

Denied need for evacuation of the area

Gates closed only after the explosion

Material

External threat

PipelinePipeline

ProceduresProcedures ManagementManagement

EnvironmentEnvironmentin bleu :

( Declarations of theFluxys management )

Ghislengien Gas explosion


Ships in Service Training Material A-M CHAUVEL Case study Using ISM Code in an Investigation 2009...

Documents

Transcript of Ships in Service Training Material A-M CHAUVEL Case study Using ISM Code in an Investigation 2009...