- Email: [email protected]
Anatomy of an incident
JCHAS-883; No of Pages 9
FEATURE
Anatomy of an incident A traditional view of incidents is that they are caused by shortcomings in human competence, attention, or attitude. It may be under the label of ‘‘loss of situational awareness,’’ procedure ‘‘violation,’’ or ‘‘poor’’ management. A different view is that human error is not the cause of failure, but a symptom of failure – trouble deeper inside the system. In this perspective, human error is not the conclusion, but rather the starting point of investigations. During an investigation, three types of information are gathered: physical, documentary, and human (recall/experience). Through the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident or condition that management has the control to fix and for which effective recommendations for corrective actions can be generated. A causal analysis identifies relevant human performance factors. In the following presentation, the anatomy of a radiological incident is discussed, and one case study is presented. The contributing factors that caused a radiological incident are analyzed. Underlying conditions, decisions, actions, and inactions that contribute to the incident are identified. This includes weaknesses that may warrant improvements that tolerate error. Measures that reduce consequences or likelihood of recurrence are discussed.
By Michael E. Cournoyer, Stanley Trujillo, Cindy M. Lawton, Whitney M. Land, Stephen B. Schreiber INTRODUCTION
The Los Alamos National Laboratory Plutonium Facility at Technical Area 55 (TA-55) handles plutonium isotopes and other actinides in a glovebox environment. Programmatic operations involve all aspects of chemical and metallurgical operations involving Michael E. Cournoyer, Los Alamos National Laboratory, Los Alamos, NM 87545, United States (Tel.: 505 665 7616; e-mail: [email protected]). Stanley Trujillo, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Cindy M. Lawton, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Whitney M. Land, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Stephen Schreiber, Los Alamos National Laboratory, Los Alamos, NM 87545, United States.
1871-5532 http://dx.doi.org/10.1016/j.jchas.2016.02.006
plutonium and other nuclear materials in support of the U.S. Department of Energy’s (DOE) nuclear weapons program. As previously reported in this Journal, the spread of radiological contamination and excursions of contaminants into the worker’s breathing-zone are minimized through the use of Integrated Safety Management (ISM).1 ISM optimizes the safety- and cost-effectiveness of performing work through an integrated management system that is based on necessary and sufficient standards to support an organization’s mission. ISM expectations are met using the safe work practices, work control process, which embeds the five-step process into its work and worker authorization process. This five-step process consists of defining the work; identifying and evaluating the hazards; developing and implementing controls; performing work safely; and providing feedback and continuous improvement. See Figure 1. Investigating incidents contributes to Step 5: Ensure Performance. An incident is an abnormal condition, accident, or deviation from the planned outcome of a workplace activity that did or could adversely affect health or safety of workers, the public, the environment, or the integrity of nuclear programs or facilities. A typical incident at TA-55 can result in worker exposure/contamination, waste generation, and work
stoppage. Before work continues, the room is usually shut down until it is cleaned up and recertified for operations. ‘‘Learning Teams’’ facilitate employee feedback loop and integration toward process improvement. A traditional view of incidents is that they are caused by shortcomings in human competence, attention, or attitude.2 It may be under the label of ‘‘loss of situational awareness,’’ procedure ‘‘violation,’’ or ‘‘poor’’ management. A new and different view is that human error is not the cause of failure, but a symptom of failure – trouble deeper inside the system. In this perspective, human error is not the conclusion, but rather the starting point of investigations. In the following presentation, the anatomy of a radiological incident is discussed, and one case study is presented. The contributing factors that caused a radiological incident are analyzed. Underlying conditions, decisions, actions, and inactions that contribute to the incident are identified. This includes weaknesses that may warrant improvements that tolerate error. Measures that reduce consequences or likelihood of recurrence are discussed.
DEFINITIONS
Red-Lighting a Room Red lights above laboratory doors, in combination with posted warnings and ribbon/rope barriers, are used to
ß Division of Chemical Health and Safety of the American Chemical Society Elsevier Inc. All rights reserved.
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
1
JCHAS-883; No of Pages 9
Figure 1. Five-step process of integrated safety management.
restrict access during radiological incident response and to restrict access to areas where certain radiological work is performed. Transuranic Waste (TRU) Waste which has been contaminated with alpha emitting transuranic radionuclides possessing half-lives greater than 20 years and in concentrations greater than 100 nCi/g (3.7 MBq/kg).
ANATOMY OF AN INCIDENT
1. The incident occurs. The incident is an abnormal condition, accident, or deviation from the planned outcome of a workplace activity that did or could adversely affect health or safety of workers, the public, the
environment, or the integrity of TA-55 programs or facilities. 2. The incident is investigated. The worker-involved meeting to discuss the incident, called the ‘‘fact finding’’ meeting, is the most immediate part of the incident investigation and plays a central role in launching an effective partnership between workers, supervisors, and managers to understand the incident and improve future performance.3,4 The most important outcome of the ‘‘fact finding’’ meeting is the establishment of a timeline. Established criteria determine reporting requirements.5 3. Causal factors are determined. When implementing the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident that management has the control to fix and for which effective recommendations for corrective actions can be generated. A model for the causal analysis process is provided the Department of Energy (DOE) Causal Analysis Tree (CAT).5 4. Conclusions are drawn. The analyst and/or evaluation team determines from the applied analyses those factors that most likely contributed to the problem and documents those conclusions. Because many factors are necessary to drive a complex system into failure, conclusions will not reflect one single root cause, which if addressed,
would prevent the same or similar incidents. The analyst and/or evaluation team, and line management are required to develop conclusions from their inquiries, evidence, and analyses regarding those individual or interrelated factors that influenced the resulting problem. The conclusions become the basis for developing improvements that provide earlier detection of a problem, allow for safe recovery from a problem, reduce the likelihood of the problem recurring, and/or reduce the consequence should a similar situation recur. 5. Corrective actions are developed. Corrective actions identify responsible parties, deliverables, and target due dates. Related Human Performance Improvement (HPI) factors are addressed, such as significant error precursors if identified, applicable error modes, any error reduction techniques used by the affected personnel or organization, and vulnerable defenses and other contributing latent conditions. Lessons Learned are communicated. The results of the incident are communicated to co-workers and work planners, and provided institutionally through the Lessons Learned processes. Lessons that may be significant and relevant to other processes, activities, or organizations are shared using the methods and tools presented in this document. Figure 2 illustrates how
Figure 2. Lessons learned integration with work performance.
2
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
Figure 3. Re-enactment of a drum falling to the floor.
the Lessons Learned Process supports work.
CASE STUDY: DRUM FALLING TO THE FLOOR
The Incident On 1/22/15, personnel were performing TRU Operations in TA-55 which involved weighing a 315 pound drum. Upon completion of weighing the drum, workers were required to tilt the drum slightly and slide it onto casters. As one of the workers began to tilt the drum, the drum began to slip and rather than attempting to catch or save the drum from falling, he made a conscious decision to step away and let it fall over on its side. See Figure 3, Re-enactment of a drum falling to the floor. Note that one worker does not have safety glasses on. This is because this specific task, the loading of empty drums does not require them. No one was injured. The Technical Lead, who was in the room at the time,
requested all personnel in the room exit into the corridor. The Technical Lead used red lights above laboratory doors, in combination with posted warnings and ribbon/rope barriers to restrict access during radiological incident response and to restrict access to areas where certain radiological work is performed. This action is called RedLighting a Room. The Technical Lead also made appropriate notifications to line management, the TA-55 Operations Center and requested Radiological Control Technician (RCT) support. RCTs responded promptly and performed area contamination surveys. No detectable activity was measured on the drum or the floor area. Later that afternoon, personnel reentered the room and placed the drum in an upright position. Personnel reperformed inspection of the drum. No visible damage was observed to the drum. Personnel generated a Non-Conformance Report (NCR). Based on a review of the drum by the appropriate Cognizant Systems Engineer and Pack-
aging Engineer it was determined that there was no damage to the drum. The NCR was invalidated on this basis and a record of the NCR and rationale for invalidation remains in the NCR system. The ‘‘Fact Finding’’ Meeting On 1/ 28/15, a fact finding meeting was held to discuss activities leading up to this incident. Timeline data include the following: A drum was tasked to be weighted as part of TRU Operations in TA-55. The assigned drum lifter was not used because it was out of certification. The assigned drum lifter did not pass the time of certification. Other drum lifters were unavailable due to space issues and the RedLighting a Room. The drum was loaded manually onto the casters. A drum fell to the floor. Management noted how the tare weight of the drum is approximately
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
3
JCHAS-883; No of Pages 9
Figure 4. Lifting and moving 55 gallon drums.
350 pounds. Although management was aware of the issues with the handling and moving of drums, process improvements had yet to be implemented. Management was currently in discussion with the TA-55 Ergonomic Specialist and Industrial Hygienists to resolve this. Management scheduled a meeting with a vendor to discuss improved handling options. Management described the process of loading the drums onto casters and then moving them over to get weighed. The following pictures show personnel demonstrating how they lift and move 55 gallon drums. See Figure 4. For weighing activities, the drum is normally lifted off the casters (via a drum lifter) and placed onto the scale. However, for this incident, personnel noticed the drum lifter was out of calibration and were required to lift/load the drum manually onto the casters. Management did discuss the weight 4
hazard involved and noted how this hazard is addressed in a work control document. Additionally, management noted how the scale is approximately 2½ inches above the ground floor requiring personnel to slightly tilt and push the drum onto the scale. The same issue occurs after weighing, where the drum is tilted slightly and pushed back onto the casters. Two processes are currently being performed to transport drums in TA-55: Empty 60 pound drums are transported on a round dolly. The initial and sustained push forces for this process are within acceptable push force guidelines.6 Initial force is the force applied to set an object in motion, i.e., force required to accelerate the object. Sustained force is the force applied to keep an object in motion, i.e., force required to keep the object at more or less constant
velocity. The process for 60 pound drums is not ideal, but safe for male workers and approaching unsafe for female workers. However, the process for 315 pound drums is unsafe for all workers; new method needed. See Table 1. Green highlighted fields indicate that it is safe for both male and female. Yellow highlighted fields indicate that it is safe for male; outside the safe range for female. Red highlighted fields indicate that it is outside the safe range for both male and female. ‘‘Man-Handling of drums is not the preferred method to maneuver 55 gallon drums. Consideration should be given to use tools and equipment first whenever feasible. Rolling drums on and off pallets, trucks or docks by hand increases the risks to cause accidents.’’ Management was trying to be proactive prior to this incident and had
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
force for the drum is 1,429 N initial force and 973 N sustained force, compared to the maximum safe limit which is 340 N initial force and 230 N sustained force. This is a concern because extreme push forces equate to a greater risk of injury to workers.
Table 1. Acceptable Push Force Guidelines.a
Ideal Condions
Maximum Limits
60 lb. Drum
315 lb. Drum
Weight of Object (kg)
Inial Force (N)
Sustained Force
Male
25.0
250
170
Female
15.0
150
89
Male
34.0
340
230
Female
22.0
220
130
Male
27.2
272
185
Female
27.2
272
161
Male
142.9
1429
973
Female
142.9
1429
845
a
The above table is for a frequency of one-eighth hour, a handle height of 95 cm for males and of 89 cm for females, and a push distance of 2 m.
contacted the TA-55 Ergo Team to assist and evaluate the movement of drums. Additionally management began researching drum handling options.
Empty 315 pound drums are transported on a round dolly. The initial and sustained push forces for this process are above the acceptable force guidelines. The current push
The following controls performed as planned: Personnel wore safety shoes. Personnel avoided a potential injury by not attempting to prevent the drum from falling. A larger incident was avoided because personnel controlled access to room (via Red-Lighting a Room), and made appropriate notifications to the TA-55 Operations Center and line management. Causal Factors A Cause-and-Effect Diagram was used to systematically review the causal factors that contribute to the incident. See Figure 5. The Institute of Nuclear Power Operations has developed a list of error precursors that are useful in preventing incidents from occurring.4 For this case study,
Figure 5. Dropped drum cause and effect diagram.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
5
JCHAS-883; No of Pages 9
Table 2. Casual Analysis Tree Causal Codes.5
Casual Factor
Casual Factor Definition
Explanation
Context
Potential Corrective Action
The scale is approximately 2½ inches above the ground floor requiring personnel to slightly tilt and push the drum onto the scale. The same problem occurs after weighing, where the drum is tilted slightly and pushed back onto the casters. The drum lifter calibration was not performed in accordance with the manufacturer’s recommended frequency for calibrations. Drum fell to the floor.
Assure design includes ease of access to area and loading/unloading.
A1B5C01
Ergonomics LTA
Inadequate ergonomic design contributed to the occurrence. An individual had difficulty reaching the equipment or assumed an awkward position to complete a task.
A2B1C01
Calibration for Equipment LTA
Drum lifter was out of calibration.
A2B4C01
Material handling LTA
A3B2C02
Signs to stop were ignored and step performed incorrectly
A3B2C04
Previous successes in use of rule reinforced continued use of rule
A4B1C01
Management policy guidance/ expectations not welldefined, understood or enforced Management direction created insufficient awareness of the impact of actions on safety/ reliability
Equipment was damaged during handling. As all work at TA-55 requires extensive planning. Workers are anxious to complete the work. This may cloud their judgment. If a rule for behavior has been used successfully in the past, there is an overwhelming tendency to apply the rule again, even though circumstances no longer warrant the use of the rule. Policy/expectation is not enforced.
A4B1C03
A4B2C08
6
Means not provided for assuring adequate equipment quality, reliability, or operability
Management failed to provide direction regarding safeguards against nonconservative actions by personnel concerning safety. A process for assuring personnel’s equipment was satisfactory did not exist.
The workers knew the proper way to move the drum was with a drum lifter, but they wanted to complete the task as soon as possible. Lifting and loading the drum manually onto the casters was successful in the past.
Zero accidents policy requires that drum be lifted off and on the casters via a drum lifter. The Technical Lead did not realized the safety impact of not using the drum lifter.
Incorporate manufacturer’s recommended frequency into the calibration program. Provide separation between distinct work packages and materials. Add ‘‘Forcing Functions’’, for example, a hold point.
Add ‘‘Forcing Functions’’, for example, a hold point.
Modify safety and security policies to balance concerns and still meet operational mission. Reexamine appropriate safeguards are integrated into management expectations.
There was not a back-up drum lifter at TA-55.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
Table 2 (Continued )
Casual Factor A4B5C02
Casual Factor Definition Change not implemented in a timely manner
Nine causal codes were determined. See Table 2. LTA is an acronym for Less Than Adequate. Engineering, equipment, human performance, and management errors have been compiled. The following factors contributed to the incident: Slippery floor surface. Lifting equipment was not available due to expired calibration and RedLighting a Room. Accounting system in PF-4 to track calibration and/or certification expirations for lifting devices and equipment did not exist, i.e., LTA. Clear owner(s) for lifting devices and equipment did not exist, i.e., LTA. Conclusions The drum slipped and fell to the ground while being loaded onto the casters, manually. The push forces for moving a drum is outside the safe limits. Drum lifter was out of
Explanation
Context
Potential Corrective Action
A change in expectations was not realized in practices within an acceptable time period.
Management was presently in the process of trying to improve how drums were handled/ moved, and was in discussion with the TA-55 Ergonomic Specialist and Industrial Hygienists. Management scheduled a meeting with a vendor to discuss improved handling options.
Review management’s implementation of Pushing, Pulling, and Lifting Waste Items and Containers.
certification. Second drum lifter unavailable due to Red-Lighting a Room. Other drum lifters are unavailable due to limited drum storage space at TA-55. Corrective Actions Appropriate corrective actions were determined. Based on recommendations from the DOE CAT, corrective actions include the following: With worker involvement identify improvements to the work control document and implement improved handling methods and equipment. Follow-up on out of certification drum handler–who owns it and why was it not inspected. Share results through the Lessons Learned Program. Lessons Learned As the results of the incident were significant and relevant to other processes, activities, and organizations, improvements were
shared through the Lessons Learned Program. The group researched drum handling options, including the following: A new cart design specifically for drum transport with better casters – easier to push – automatic brakes – handle = better to maneuver, easy to load drum. See Figure 6. New Drum Lifter with built-in scale was purchased. The new drum lifters not only assist workers with loading drums onto casters, but eliminate the need for moving the drum to get weighed. See Figure 7. An 8-wheel drum dolly casters replaced the traditional 4-wheel drum dolly/casters, and has a 2,000 pound capacity. See Figure 8. New casters significantly reduce potential for tipping of drums when moving.
Figure 6. New cart design.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
7
JCHAS-883; No of Pages 9
Figure 8. 8-Wheel drum dolly.
Figure 7. New drum lifter with built-in scale. DISCUSSION
Incidents where a drum slips and falls to the ground while being loaded onto the casters may not warrant management attention in the non-nuclear facility environment. In the nuclear facility world, this type of incident is considered a ‘‘near miss,’’ i.e., an unplanned event that did not result in injury, illness, or damage – but had the potential to do so. If a drum filled with an alpha emitter ruptures, excursions of alpha emitters into the operator’s breathing zone are possible.7 Although some external exposure is expected when working with alpha emitters, internal exposure is not. Primary objectives of an organization should be to conduct all operations in a disciplined and controlled manner, to maintain a safe and healthy workplace for personnel, and to protect the public and the environment. When an incident occurs, a ‘‘fact finding’’ meeting must be held as soon as possible afterwards. Ideally, the ‘‘fact finding’’ meeting should be held the same day as the incident. Attendance in the worker/responder portion of the ‘‘fact finding’’ meeting must be held to the minimum necessary and sufficient to understand the incident and immediate response. Supervisors and first line managers are encouraged to attend, but to maintain a manageable size and candid environment, managers above group level are encouraged to defer attendance to the ‘‘fact 8
finding’’ closeout meeting or post-’’ fact finding’’ follow-on meetings. The ‘‘fact finding’’ meeting must be an open discussion forum, never a blame placing session. Incident investigation is often perceived as a punitive process. Combating this perception begins at the ‘‘fact finding’’ meeting, where all managers in attendance must take active steps to set and maintain a tone of learning from the experience rather than finding fault with individuals. Involved workers, responders, managers and subject matter experts called upon to attend the ‘‘fact finding’’ meeting must candidly explain the sequence of incidents leading up to, during, and immediately following the incident, participate openly and effectively in the problem-solving discussion, and cooperate fully with the ‘‘fact finding’’ meeting leader. As shown in the case study, causal analysis provides additional insights in determining the causes of drum handling incidents. Causal analysis is not a guarantee that similar incidents or conditions will recur. The use of Cause and Effect Diagrams in the analysis of glove breaches and failures, air-purifying respirator incidents, have been previously reported in this journal.3,4,8 The Cause-Effect Diagram was used in this analysis because it is a good tool for examining condition-related problems, as shown in Figure 5. Not using a drum lifter was the active error that triggered the immediate, undesired consequences: dropped drum, as
shown in Table 2. While it is typical to blame the worker, error precursors with the drum lifter and management also contributed to the incident. In this case study, management methods, change management, and resource management issues were uncovered. Human Performance factors must be considered for any incident-based causal analysis at any level of rigor. HPI Tools such as the Cause-Effect Diagram and Casual Analysis Tree Causal Codes support this analysis. Relevant human performance factors identified during the analysis must be incorporated in the resulting analysis documentation. Recognizing and appreciating human performance principles is an element of any incident-based causal analysis. Human performance analysis is not considered a discrete type of analysis, but informs the analysis and conclusions. This perspective supports an appreciation on the part of the analyst, management, and/or evaluation team regarding the complexity of systems in which people work, the goal conflicts that personnel must constantly manage, the changing conditions they respond to (usually people respond to them well and without incident), and the incentives that are at work in their environments. Appreciation for human performance principles within analysis translates to a deliberate effort to understand the context in which personnel identify information within their environment, process that information, interpret it, and make decisions that translate into subsequent actions. Analysis includes a review of significant error precursors, the mode of operation in which an error was
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
made, latent equipment and facility conditions that existed at the time the activity was executed, and surrounding management system factors that are developed as work is imagined, versus as work is executed. When implementing the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident or condition that management has the control to fix and for which effective recommendations for corrective actions can be generated. The traditional view depends upon the person or institution. Many recognize that there are root causes to incidents that need to address the symptoms reflected by the event. Incorporating corrective actions selected from the DOE CAT has its advantages.4 These corrective actions have been developed from incidents that have been archived over decades. While all Laboratory workers are encouraged to have a role in the receipt and distribution of lessons learned, it is the responsibility of managers to model and work with their employees to integrate best practices and lessons learned into daily work performance. Relevant lessons learned are distributed to management in many different forms on a regular basis. These Lessons Learned may be group-, facility-, site-, or DOE Complex-wide. These lessons should be evaluated for relevance and improvement opportunities, and incorporated into existing work processes as appropriate. While lessons learned notifications are made through institutional
channels, employees will be notified primarily of lessons relevant to their job through their management chain, through local processes or by Subject Matter Experts (SMEs). Some common forms of notifications that management currently use include all employee organizational meetings, pre-job briefings, project update meetings, design review meetings, and plan-of-the-day or plan-of-the-week meetings. In summary, a drum fell to the floor because it was being loaded onto the casters, manually instead of using a drum lifter. The assigned drum lifter was not used because it was out of certification. Other drum lifters were unavailable due to space issues and the Red-Lighting a Room. Fortunately, no one was hurt. A slippery floor surface was a contributing factor. Improvements to the task include a new cart design, a new drum lifter with built-in scale, and an 8-Wheel Drum Dolly. These improvements were shared through a Lessons Learned Program.
CONCLUSIONS
Causal analysis of drum handling incidents uncovered contributing factors that created the environment in which the incident existed. Latent organizational conditions that create error-likely situations or weaken defenses have been identified and controlled. Effective improvements have been implemented that reduce the probability or consequence of similar drum handling incidents. This increases technical
knowledge and augments operational safety. ACKNOWLEDGEMENTS The authors would like to acknowledge the U.S. Department of Energy and LANL’s Plutonium Science & Manufacturing, Environment, Safety, Health, and Nuclear & High Hazard Operations directorates for support of this work. REFERENCES 1. Cournoyer, M. E.; Maestas, M. M. Addressing safety requirements through management walk-arounds (MWAs). J. Chem. Health Saf. 2014, 11(6), 12–16. 2. Paraphrased from DOE Standard Human Performance Handbook, Volume 2: Human Performance Tools for Individuals, Work Teams, and Management. 3. Cournoyer, M. E.; et al. Elements of a glovebox glove integrity program. J. Chem. Health Saf. 2009, 16(1), 4–10. 4. Cournoyer, M. E.; et al. Causal analysis of a glovebox glove breach. J. Chem. Health Saf. 2013, 20(2), 26–33. 5. DOE-STD-1197-2011. DOE Standard Occurrence Reporting Causal Analysis, September 2011. 6. International Standard ISO 11228-2. Ergonomics – Manual Handling – Part 2: Pushing and Pulling, 2007. 7. Cournoyer, M. E.; et al. Lean six sigma tools, part II: Output metrics for a glovebox glove integrity program. J. Chem. Health Saf. 2011, 18(1), 22–30. 8. Cournoyer, M. E.; et al. Application of lean six sigma business practices to an air purifying respirator program. J. Chem. Health Saf. 2013, 20(5), 8–13.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
9
FEATURE
Anatomy of an incident A traditional view of incidents is that they are caused by shortcomings in human competence, attention, or attitude. It may be under the label of ‘‘loss of situational awareness,’’ procedure ‘‘violation,’’ or ‘‘poor’’ management. A different view is that human error is not the cause of failure, but a symptom of failure – trouble deeper inside the system. In this perspective, human error is not the conclusion, but rather the starting point of investigations. During an investigation, three types of information are gathered: physical, documentary, and human (recall/experience). Through the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident or condition that management has the control to fix and for which effective recommendations for corrective actions can be generated. A causal analysis identifies relevant human performance factors. In the following presentation, the anatomy of a radiological incident is discussed, and one case study is presented. The contributing factors that caused a radiological incident are analyzed. Underlying conditions, decisions, actions, and inactions that contribute to the incident are identified. This includes weaknesses that may warrant improvements that tolerate error. Measures that reduce consequences or likelihood of recurrence are discussed.
By Michael E. Cournoyer, Stanley Trujillo, Cindy M. Lawton, Whitney M. Land, Stephen B. Schreiber INTRODUCTION
The Los Alamos National Laboratory Plutonium Facility at Technical Area 55 (TA-55) handles plutonium isotopes and other actinides in a glovebox environment. Programmatic operations involve all aspects of chemical and metallurgical operations involving Michael E. Cournoyer, Los Alamos National Laboratory, Los Alamos, NM 87545, United States (Tel.: 505 665 7616; e-mail: [email protected]). Stanley Trujillo, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Cindy M. Lawton, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Whitney M. Land, Los Alamos National Laboratory, Los Alamos, NM 87545, United States. Stephen Schreiber, Los Alamos National Laboratory, Los Alamos, NM 87545, United States.
1871-5532 http://dx.doi.org/10.1016/j.jchas.2016.02.006
plutonium and other nuclear materials in support of the U.S. Department of Energy’s (DOE) nuclear weapons program. As previously reported in this Journal, the spread of radiological contamination and excursions of contaminants into the worker’s breathing-zone are minimized through the use of Integrated Safety Management (ISM).1 ISM optimizes the safety- and cost-effectiveness of performing work through an integrated management system that is based on necessary and sufficient standards to support an organization’s mission. ISM expectations are met using the safe work practices, work control process, which embeds the five-step process into its work and worker authorization process. This five-step process consists of defining the work; identifying and evaluating the hazards; developing and implementing controls; performing work safely; and providing feedback and continuous improvement. See Figure 1. Investigating incidents contributes to Step 5: Ensure Performance. An incident is an abnormal condition, accident, or deviation from the planned outcome of a workplace activity that did or could adversely affect health or safety of workers, the public, the environment, or the integrity of nuclear programs or facilities. A typical incident at TA-55 can result in worker exposure/contamination, waste generation, and work
stoppage. Before work continues, the room is usually shut down until it is cleaned up and recertified for operations. ‘‘Learning Teams’’ facilitate employee feedback loop and integration toward process improvement. A traditional view of incidents is that they are caused by shortcomings in human competence, attention, or attitude.2 It may be under the label of ‘‘loss of situational awareness,’’ procedure ‘‘violation,’’ or ‘‘poor’’ management. A new and different view is that human error is not the cause of failure, but a symptom of failure – trouble deeper inside the system. In this perspective, human error is not the conclusion, but rather the starting point of investigations. In the following presentation, the anatomy of a radiological incident is discussed, and one case study is presented. The contributing factors that caused a radiological incident are analyzed. Underlying conditions, decisions, actions, and inactions that contribute to the incident are identified. This includes weaknesses that may warrant improvements that tolerate error. Measures that reduce consequences or likelihood of recurrence are discussed.
DEFINITIONS
Red-Lighting a Room Red lights above laboratory doors, in combination with posted warnings and ribbon/rope barriers, are used to
ß Division of Chemical Health and Safety of the American Chemical Society Elsevier Inc. All rights reserved.
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
1
JCHAS-883; No of Pages 9
Figure 1. Five-step process of integrated safety management.
restrict access during radiological incident response and to restrict access to areas where certain radiological work is performed. Transuranic Waste (TRU) Waste which has been contaminated with alpha emitting transuranic radionuclides possessing half-lives greater than 20 years and in concentrations greater than 100 nCi/g (3.7 MBq/kg).
ANATOMY OF AN INCIDENT
1. The incident occurs. The incident is an abnormal condition, accident, or deviation from the planned outcome of a workplace activity that did or could adversely affect health or safety of workers, the public, the
environment, or the integrity of TA-55 programs or facilities. 2. The incident is investigated. The worker-involved meeting to discuss the incident, called the ‘‘fact finding’’ meeting, is the most immediate part of the incident investigation and plays a central role in launching an effective partnership between workers, supervisors, and managers to understand the incident and improve future performance.3,4 The most important outcome of the ‘‘fact finding’’ meeting is the establishment of a timeline. Established criteria determine reporting requirements.5 3. Causal factors are determined. When implementing the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident that management has the control to fix and for which effective recommendations for corrective actions can be generated. A model for the causal analysis process is provided the Department of Energy (DOE) Causal Analysis Tree (CAT).5 4. Conclusions are drawn. The analyst and/or evaluation team determines from the applied analyses those factors that most likely contributed to the problem and documents those conclusions. Because many factors are necessary to drive a complex system into failure, conclusions will not reflect one single root cause, which if addressed,
would prevent the same or similar incidents. The analyst and/or evaluation team, and line management are required to develop conclusions from their inquiries, evidence, and analyses regarding those individual or interrelated factors that influenced the resulting problem. The conclusions become the basis for developing improvements that provide earlier detection of a problem, allow for safe recovery from a problem, reduce the likelihood of the problem recurring, and/or reduce the consequence should a similar situation recur. 5. Corrective actions are developed. Corrective actions identify responsible parties, deliverables, and target due dates. Related Human Performance Improvement (HPI) factors are addressed, such as significant error precursors if identified, applicable error modes, any error reduction techniques used by the affected personnel or organization, and vulnerable defenses and other contributing latent conditions. Lessons Learned are communicated. The results of the incident are communicated to co-workers and work planners, and provided institutionally through the Lessons Learned processes. Lessons that may be significant and relevant to other processes, activities, or organizations are shared using the methods and tools presented in this document. Figure 2 illustrates how
Figure 2. Lessons learned integration with work performance.
2
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
Figure 3. Re-enactment of a drum falling to the floor.
the Lessons Learned Process supports work.
CASE STUDY: DRUM FALLING TO THE FLOOR
The Incident On 1/22/15, personnel were performing TRU Operations in TA-55 which involved weighing a 315 pound drum. Upon completion of weighing the drum, workers were required to tilt the drum slightly and slide it onto casters. As one of the workers began to tilt the drum, the drum began to slip and rather than attempting to catch or save the drum from falling, he made a conscious decision to step away and let it fall over on its side. See Figure 3, Re-enactment of a drum falling to the floor. Note that one worker does not have safety glasses on. This is because this specific task, the loading of empty drums does not require them. No one was injured. The Technical Lead, who was in the room at the time,
requested all personnel in the room exit into the corridor. The Technical Lead used red lights above laboratory doors, in combination with posted warnings and ribbon/rope barriers to restrict access during radiological incident response and to restrict access to areas where certain radiological work is performed. This action is called RedLighting a Room. The Technical Lead also made appropriate notifications to line management, the TA-55 Operations Center and requested Radiological Control Technician (RCT) support. RCTs responded promptly and performed area contamination surveys. No detectable activity was measured on the drum or the floor area. Later that afternoon, personnel reentered the room and placed the drum in an upright position. Personnel reperformed inspection of the drum. No visible damage was observed to the drum. Personnel generated a Non-Conformance Report (NCR). Based on a review of the drum by the appropriate Cognizant Systems Engineer and Pack-
aging Engineer it was determined that there was no damage to the drum. The NCR was invalidated on this basis and a record of the NCR and rationale for invalidation remains in the NCR system. The ‘‘Fact Finding’’ Meeting On 1/ 28/15, a fact finding meeting was held to discuss activities leading up to this incident. Timeline data include the following: A drum was tasked to be weighted as part of TRU Operations in TA-55. The assigned drum lifter was not used because it was out of certification. The assigned drum lifter did not pass the time of certification. Other drum lifters were unavailable due to space issues and the RedLighting a Room. The drum was loaded manually onto the casters. A drum fell to the floor. Management noted how the tare weight of the drum is approximately
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
3
JCHAS-883; No of Pages 9
Figure 4. Lifting and moving 55 gallon drums.
350 pounds. Although management was aware of the issues with the handling and moving of drums, process improvements had yet to be implemented. Management was currently in discussion with the TA-55 Ergonomic Specialist and Industrial Hygienists to resolve this. Management scheduled a meeting with a vendor to discuss improved handling options. Management described the process of loading the drums onto casters and then moving them over to get weighed. The following pictures show personnel demonstrating how they lift and move 55 gallon drums. See Figure 4. For weighing activities, the drum is normally lifted off the casters (via a drum lifter) and placed onto the scale. However, for this incident, personnel noticed the drum lifter was out of calibration and were required to lift/load the drum manually onto the casters. Management did discuss the weight 4
hazard involved and noted how this hazard is addressed in a work control document. Additionally, management noted how the scale is approximately 2½ inches above the ground floor requiring personnel to slightly tilt and push the drum onto the scale. The same issue occurs after weighing, where the drum is tilted slightly and pushed back onto the casters. Two processes are currently being performed to transport drums in TA-55: Empty 60 pound drums are transported on a round dolly. The initial and sustained push forces for this process are within acceptable push force guidelines.6 Initial force is the force applied to set an object in motion, i.e., force required to accelerate the object. Sustained force is the force applied to keep an object in motion, i.e., force required to keep the object at more or less constant
velocity. The process for 60 pound drums is not ideal, but safe for male workers and approaching unsafe for female workers. However, the process for 315 pound drums is unsafe for all workers; new method needed. See Table 1. Green highlighted fields indicate that it is safe for both male and female. Yellow highlighted fields indicate that it is safe for male; outside the safe range for female. Red highlighted fields indicate that it is outside the safe range for both male and female. ‘‘Man-Handling of drums is not the preferred method to maneuver 55 gallon drums. Consideration should be given to use tools and equipment first whenever feasible. Rolling drums on and off pallets, trucks or docks by hand increases the risks to cause accidents.’’ Management was trying to be proactive prior to this incident and had
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
force for the drum is 1,429 N initial force and 973 N sustained force, compared to the maximum safe limit which is 340 N initial force and 230 N sustained force. This is a concern because extreme push forces equate to a greater risk of injury to workers.
Table 1. Acceptable Push Force Guidelines.a
Ideal Condions
Maximum Limits
60 lb. Drum
315 lb. Drum
Weight of Object (kg)
Inial Force (N)
Sustained Force
Male
25.0
250
170
Female
15.0
150
89
Male
34.0
340
230
Female
22.0
220
130
Male
27.2
272
185
Female
27.2
272
161
Male
142.9
1429
973
Female
142.9
1429
845
a
The above table is for a frequency of one-eighth hour, a handle height of 95 cm for males and of 89 cm for females, and a push distance of 2 m.
contacted the TA-55 Ergo Team to assist and evaluate the movement of drums. Additionally management began researching drum handling options.
Empty 315 pound drums are transported on a round dolly. The initial and sustained push forces for this process are above the acceptable force guidelines. The current push
The following controls performed as planned: Personnel wore safety shoes. Personnel avoided a potential injury by not attempting to prevent the drum from falling. A larger incident was avoided because personnel controlled access to room (via Red-Lighting a Room), and made appropriate notifications to the TA-55 Operations Center and line management. Causal Factors A Cause-and-Effect Diagram was used to systematically review the causal factors that contribute to the incident. See Figure 5. The Institute of Nuclear Power Operations has developed a list of error precursors that are useful in preventing incidents from occurring.4 For this case study,
Figure 5. Dropped drum cause and effect diagram.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
5
JCHAS-883; No of Pages 9
Table 2. Casual Analysis Tree Causal Codes.5
Casual Factor
Casual Factor Definition
Explanation
Context
Potential Corrective Action
The scale is approximately 2½ inches above the ground floor requiring personnel to slightly tilt and push the drum onto the scale. The same problem occurs after weighing, where the drum is tilted slightly and pushed back onto the casters. The drum lifter calibration was not performed in accordance with the manufacturer’s recommended frequency for calibrations. Drum fell to the floor.
Assure design includes ease of access to area and loading/unloading.
A1B5C01
Ergonomics LTA
Inadequate ergonomic design contributed to the occurrence. An individual had difficulty reaching the equipment or assumed an awkward position to complete a task.
A2B1C01
Calibration for Equipment LTA
Drum lifter was out of calibration.
A2B4C01
Material handling LTA
A3B2C02
Signs to stop were ignored and step performed incorrectly
A3B2C04
Previous successes in use of rule reinforced continued use of rule
A4B1C01
Management policy guidance/ expectations not welldefined, understood or enforced Management direction created insufficient awareness of the impact of actions on safety/ reliability
Equipment was damaged during handling. As all work at TA-55 requires extensive planning. Workers are anxious to complete the work. This may cloud their judgment. If a rule for behavior has been used successfully in the past, there is an overwhelming tendency to apply the rule again, even though circumstances no longer warrant the use of the rule. Policy/expectation is not enforced.
A4B1C03
A4B2C08
6
Means not provided for assuring adequate equipment quality, reliability, or operability
Management failed to provide direction regarding safeguards against nonconservative actions by personnel concerning safety. A process for assuring personnel’s equipment was satisfactory did not exist.
The workers knew the proper way to move the drum was with a drum lifter, but they wanted to complete the task as soon as possible. Lifting and loading the drum manually onto the casters was successful in the past.
Zero accidents policy requires that drum be lifted off and on the casters via a drum lifter. The Technical Lead did not realized the safety impact of not using the drum lifter.
Incorporate manufacturer’s recommended frequency into the calibration program. Provide separation between distinct work packages and materials. Add ‘‘Forcing Functions’’, for example, a hold point.
Add ‘‘Forcing Functions’’, for example, a hold point.
Modify safety and security policies to balance concerns and still meet operational mission. Reexamine appropriate safeguards are integrated into management expectations.
There was not a back-up drum lifter at TA-55.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
Table 2 (Continued )
Casual Factor A4B5C02
Casual Factor Definition Change not implemented in a timely manner
Nine causal codes were determined. See Table 2. LTA is an acronym for Less Than Adequate. Engineering, equipment, human performance, and management errors have been compiled. The following factors contributed to the incident: Slippery floor surface. Lifting equipment was not available due to expired calibration and RedLighting a Room. Accounting system in PF-4 to track calibration and/or certification expirations for lifting devices and equipment did not exist, i.e., LTA. Clear owner(s) for lifting devices and equipment did not exist, i.e., LTA. Conclusions The drum slipped and fell to the ground while being loaded onto the casters, manually. The push forces for moving a drum is outside the safe limits. Drum lifter was out of
Explanation
Context
Potential Corrective Action
A change in expectations was not realized in practices within an acceptable time period.
Management was presently in the process of trying to improve how drums were handled/ moved, and was in discussion with the TA-55 Ergonomic Specialist and Industrial Hygienists. Management scheduled a meeting with a vendor to discuss improved handling options.
Review management’s implementation of Pushing, Pulling, and Lifting Waste Items and Containers.
certification. Second drum lifter unavailable due to Red-Lighting a Room. Other drum lifters are unavailable due to limited drum storage space at TA-55. Corrective Actions Appropriate corrective actions were determined. Based on recommendations from the DOE CAT, corrective actions include the following: With worker involvement identify improvements to the work control document and implement improved handling methods and equipment. Follow-up on out of certification drum handler–who owns it and why was it not inspected. Share results through the Lessons Learned Program. Lessons Learned As the results of the incident were significant and relevant to other processes, activities, and organizations, improvements were
shared through the Lessons Learned Program. The group researched drum handling options, including the following: A new cart design specifically for drum transport with better casters – easier to push – automatic brakes – handle = better to maneuver, easy to load drum. See Figure 6. New Drum Lifter with built-in scale was purchased. The new drum lifters not only assist workers with loading drums onto casters, but eliminate the need for moving the drum to get weighed. See Figure 7. An 8-wheel drum dolly casters replaced the traditional 4-wheel drum dolly/casters, and has a 2,000 pound capacity. See Figure 8. New casters significantly reduce potential for tipping of drums when moving.
Figure 6. New cart design.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
7
JCHAS-883; No of Pages 9
Figure 8. 8-Wheel drum dolly.
Figure 7. New drum lifter with built-in scale. DISCUSSION
Incidents where a drum slips and falls to the ground while being loaded onto the casters may not warrant management attention in the non-nuclear facility environment. In the nuclear facility world, this type of incident is considered a ‘‘near miss,’’ i.e., an unplanned event that did not result in injury, illness, or damage – but had the potential to do so. If a drum filled with an alpha emitter ruptures, excursions of alpha emitters into the operator’s breathing zone are possible.7 Although some external exposure is expected when working with alpha emitters, internal exposure is not. Primary objectives of an organization should be to conduct all operations in a disciplined and controlled manner, to maintain a safe and healthy workplace for personnel, and to protect the public and the environment. When an incident occurs, a ‘‘fact finding’’ meeting must be held as soon as possible afterwards. Ideally, the ‘‘fact finding’’ meeting should be held the same day as the incident. Attendance in the worker/responder portion of the ‘‘fact finding’’ meeting must be held to the minimum necessary and sufficient to understand the incident and immediate response. Supervisors and first line managers are encouraged to attend, but to maintain a manageable size and candid environment, managers above group level are encouraged to defer attendance to the ‘‘fact 8
finding’’ closeout meeting or post-’’ fact finding’’ follow-on meetings. The ‘‘fact finding’’ meeting must be an open discussion forum, never a blame placing session. Incident investigation is often perceived as a punitive process. Combating this perception begins at the ‘‘fact finding’’ meeting, where all managers in attendance must take active steps to set and maintain a tone of learning from the experience rather than finding fault with individuals. Involved workers, responders, managers and subject matter experts called upon to attend the ‘‘fact finding’’ meeting must candidly explain the sequence of incidents leading up to, during, and immediately following the incident, participate openly and effectively in the problem-solving discussion, and cooperate fully with the ‘‘fact finding’’ meeting leader. As shown in the case study, causal analysis provides additional insights in determining the causes of drum handling incidents. Causal analysis is not a guarantee that similar incidents or conditions will recur. The use of Cause and Effect Diagrams in the analysis of glove breaches and failures, air-purifying respirator incidents, have been previously reported in this journal.3,4,8 The Cause-Effect Diagram was used in this analysis because it is a good tool for examining condition-related problems, as shown in Figure 5. Not using a drum lifter was the active error that triggered the immediate, undesired consequences: dropped drum, as
shown in Table 2. While it is typical to blame the worker, error precursors with the drum lifter and management also contributed to the incident. In this case study, management methods, change management, and resource management issues were uncovered. Human Performance factors must be considered for any incident-based causal analysis at any level of rigor. HPI Tools such as the Cause-Effect Diagram and Casual Analysis Tree Causal Codes support this analysis. Relevant human performance factors identified during the analysis must be incorporated in the resulting analysis documentation. Recognizing and appreciating human performance principles is an element of any incident-based causal analysis. Human performance analysis is not considered a discrete type of analysis, but informs the analysis and conclusions. This perspective supports an appreciation on the part of the analyst, management, and/or evaluation team regarding the complexity of systems in which people work, the goal conflicts that personnel must constantly manage, the changing conditions they respond to (usually people respond to them well and without incident), and the incentives that are at work in their environments. Appreciation for human performance principles within analysis translates to a deliberate effort to understand the context in which personnel identify information within their environment, process that information, interpret it, and make decisions that translate into subsequent actions. Analysis includes a review of significant error precursors, the mode of operation in which an error was
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
JCHAS-883; No of Pages 9
made, latent equipment and facility conditions that existed at the time the activity was executed, and surrounding management system factors that are developed as work is imagined, versus as work is executed. When implementing the causal analysis process, apparent cause or apparent causes are identified as the most probable cause or causes of an incident or condition that management has the control to fix and for which effective recommendations for corrective actions can be generated. The traditional view depends upon the person or institution. Many recognize that there are root causes to incidents that need to address the symptoms reflected by the event. Incorporating corrective actions selected from the DOE CAT has its advantages.4 These corrective actions have been developed from incidents that have been archived over decades. While all Laboratory workers are encouraged to have a role in the receipt and distribution of lessons learned, it is the responsibility of managers to model and work with their employees to integrate best practices and lessons learned into daily work performance. Relevant lessons learned are distributed to management in many different forms on a regular basis. These Lessons Learned may be group-, facility-, site-, or DOE Complex-wide. These lessons should be evaluated for relevance and improvement opportunities, and incorporated into existing work processes as appropriate. While lessons learned notifications are made through institutional
channels, employees will be notified primarily of lessons relevant to their job through their management chain, through local processes or by Subject Matter Experts (SMEs). Some common forms of notifications that management currently use include all employee organizational meetings, pre-job briefings, project update meetings, design review meetings, and plan-of-the-day or plan-of-the-week meetings. In summary, a drum fell to the floor because it was being loaded onto the casters, manually instead of using a drum lifter. The assigned drum lifter was not used because it was out of certification. Other drum lifters were unavailable due to space issues and the Red-Lighting a Room. Fortunately, no one was hurt. A slippery floor surface was a contributing factor. Improvements to the task include a new cart design, a new drum lifter with built-in scale, and an 8-Wheel Drum Dolly. These improvements were shared through a Lessons Learned Program.
CONCLUSIONS
Causal analysis of drum handling incidents uncovered contributing factors that created the environment in which the incident existed. Latent organizational conditions that create error-likely situations or weaken defenses have been identified and controlled. Effective improvements have been implemented that reduce the probability or consequence of similar drum handling incidents. This increases technical
knowledge and augments operational safety. ACKNOWLEDGEMENTS The authors would like to acknowledge the U.S. Department of Energy and LANL’s Plutonium Science & Manufacturing, Environment, Safety, Health, and Nuclear & High Hazard Operations directorates for support of this work. REFERENCES 1. Cournoyer, M. E.; Maestas, M. M. Addressing safety requirements through management walk-arounds (MWAs). J. Chem. Health Saf. 2014, 11(6), 12–16. 2. Paraphrased from DOE Standard Human Performance Handbook, Volume 2: Human Performance Tools for Individuals, Work Teams, and Management. 3. Cournoyer, M. E.; et al. Elements of a glovebox glove integrity program. J. Chem. Health Saf. 2009, 16(1), 4–10. 4. Cournoyer, M. E.; et al. Causal analysis of a glovebox glove breach. J. Chem. Health Saf. 2013, 20(2), 26–33. 5. DOE-STD-1197-2011. DOE Standard Occurrence Reporting Causal Analysis, September 2011. 6. International Standard ISO 11228-2. Ergonomics – Manual Handling – Part 2: Pushing and Pulling, 2007. 7. Cournoyer, M. E.; et al. Lean six sigma tools, part II: Output metrics for a glovebox glove integrity program. J. Chem. Health Saf. 2011, 18(1), 22–30. 8. Cournoyer, M. E.; et al. Application of lean six sigma business practices to an air purifying respirator program. J. Chem. Health Saf. 2013, 20(5), 8–13.
Journal of Chemical Health & Safety, March/April 2016
Please cite this article in press as: Cournoyer, M. E. et al., Anatomy of an incident. J. Chem. Health Safety (2016), http://dx.doi.org/ 10.1016/j.jchas.2016.02.006
9