Learning from Failures: Decision Analysis of Major Disasters

Learning from Failures

Decision Analysis of Major Disasters

Ashraf Labib

Table of Contents

Cover image

Title page

Copyright

Acknowledgments

Part 1: Background of Analytical Methods Used in Investigation of Disasters

Chapter 1. Introduction to the Concept of Learning from Failures

1.1 Introduction

1.2 Why Learning from Failures?

1.3 The Background of This Book

1.4 Who Should Use This Book

1.5 Introduction to the Concept of Learning from Failures

1.6 Taxonomy of Theories

1.7 Case Studies

1.8 Critical Commentary Section

Chapter 2. Introduction to Failure Analysis Techniques in Reliability Modeling

2.1 Introduction

2.2 FTA and RBD

2.3 Example: A Storage Tank

2.4 A Simple Illustrative Application Case (A Car Accident)

Chapter 3. Introduction to the Analytic Hierarchy Process

3.1 Introduction

3.2 An Overview of the Analytical Hierarchy Process

3.3 Conclusion and Future Developments

Part 2: A–Z of Disastrous Case Studies

Chapter 4. Bhopal Disaster—Learning from Failures and Evaluating Risk

4.1 Introduction

4.2 Bhopal Narrative and the Incorporation of FTA and RBD

4.3 Theory/Calculation

4.4 Discussion

4.5 Concluding Remarks

4.6 Critical Commentary Section

Chapter 5. BP Deepwater Horizon

5.1 Case Study Deepwater Horizon

5.2 Analysis of First Group of Students

5.3 Analysis of Second Group of Students

5.4 Analysis of Third Group of Students

5.5 Feedback and Generic Lessons

5.6 Critical Commentary Section

Chapter 6. BP Texas City Disaster

6.1 What Happened

6.2 The Process

6.3 Sequence of Events and Incident

6.4 Investigation

6.5 Fault Tree Analysis and Reliability Block Diagram for the Texas City Disaster

6.6 Generic Lessons

6.7 Critical Commentary Section

Chapter 7. Chernobyl Disaster

7.1 Introduction

7.2 What Happened

7.3 The Technical and Logic of the Failure

7.4 Causes of the Incident

7.5 Fault Tree Analysis and Reliability Block Diagram for the Disaster

7.6 Generic Lessons and Proposed Improvements

7.7 Critical Commentary Section

Chapter 8. The Concorde Crash

Notation

8.1 Introduction

8.2 The Accident

8.3 Theory and Use of γ Analysis (Modified FMEA)

8.4 Application of the AHP to the Concorde Accident

8.5 Analysis of Results

8.6 Conclusion

8.7 Critical Commentary Section

Chapter 9. Fukushima Nuclear Disaster

9.1 Brief Introduction

9.2 Analysis of First Group of Delegates

9.3 Analysis of Second Group of Delegates

9.4 Feedback and Generic Lessons

9.5 Critical Commentary Section

Chapter 10. Hurricane Katrina Disaster

10.1 Introduction

10.2 Background to the Disaster

10.3 Technical Causes of Failure

10.4 Hybrid Modeling Approach

10.5 Fault Tree Analysis

10.6 Reliability Block Diagram

10.7 Failure Modes, Effects, and Criticality Analysis

10.8 An AHP Model for the Hurricane Katrina Disaster

10.9 Results of Sensitivity Analysis

10.10 Discussion and Lessons Learned

10.11 Concluding Remarks

Chapter 11. NASA’s Space Shuttle Columbia Accident

11.1 What Happened?

11.2 Logic of the Technical Causes of the Failure

11.3 Consequences and Severity

11.4 Proposed Improvements and Generic Lessons

11.5 FTA and RBD

11.6 Generic Lessons

11.7 Concluding Remarks

11.8 Critical Commentary Section

Chapter 12. Titanic, the Unsinkable Ship That Sank

12.1 Cruising

12.2 What Happened

12.3 Logic of the Technical Cause of the Disaster

12.4 Consequences and Severity

12.5 FTA and RBD for the Disaster

12.6 Proposed Improvements and Generic Lessons

Part 3: Generic Lessons, Other Models of Learning from Failures and Research Directions

Chapter 13. Introduction to the Concept of the Generic Lesson as an Outcome of Learning from Failures

13.1 Why Failure Can Be the Best Thing to Happen

13.2 Attributes of the Generic Lessons

13.3 Best Practice of Learning from Failures from Different Industries

13.4 Best Practice Can Be Learned from Worst Practice

Chapter 14. A Model of Learning and Unlearning from Failures

14.1 Introduction

14.2 Research Methodology

14.3 Routine Dynamics in Learning and Unlearning from Failures

14.4 A New Theory of Routines for Adaptive Organizational Learning from Failures

14.5 Case Study of Applying the Proposed Model to a Disaster Analysis

14.6 Theoretical Framework and Discussion

14.7 Conclusion

Not Just Rearranging the Deckchairs on the Titanic: Learning from Failures Through Risk and Reliability Analysis

Abstract:

Introduction:

Learning from Failures as a Process Study

Case Studies:

Case Study 4: NASA’s Space Shuttle Columbia Accident

Technical and Logic Cause of the Failure:

Concluding Remarks

Appendix A: Fault Tree Analysis (FTA):

Reliability Block Diagrams (RBD)

Acknowledgement:

References

References

Other Related Literature

Glossary of Terms

Index

Copyright

Butterworth-Heinemann is an imprint of Elsevier

The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, UK

225 Wyman Street, Waltham, MA 02451, USA

First edition 2014

Copyright © 2014 Elsevier Inc. All rights reserved

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangement with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions

This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).

Notice

Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.

British Library Cataloguing-in-Publication Data

A catalogue record for this book is available from the British Library

Library of Congress Cataloging-in-Publication Data

A catalog record for this book is availabe from the Library of Congress

ISBN: 978-0-12-416727-8

For information on all Butterworth-Heinemann publications visit our web site at books.elsevier.com

Printed and bound in the United States of America

14 15 16 17 18 10 9 8 7 6 5 4 3 2 1

Acknowledgments

I would like to thank the many people who have motivated, inspired and provided me with valuable information and ideas that have contributed to this book. My mother, Prof (Emiritus) Aida Nossier-Labib, for her encouragement, Mr. John Harris for editing the whole manuscript, Fiona Geraghty, and Cari Owen from Elsevier for their professional support. Also, special thanks to Ms. Pauline Wilkinson – Project Manager from Elsevier for making the final proofs.

I am also grateful to my colleagues and students who have contributed to the different chapters of the book. For Chapter 4, I am grateful to John Unwin, Paul McGibney, and Mazen Al-Shanfari, from University of Glasgow Caledonian, who helped to collect the data for the Bhopal case study. I am also grateful to Rebecca Harris for the proof reading and editing. I am also grateful to John Harris for his valuable feedback and comments. I am grateful to my co-authors Ramesh Champaneri and Alessio Ishizaka for the two related papers co-authored ion this subject.

For Chapter 5, I am grateful to my students at both University of Manchester (MSc Reliability Engineering) and University of Portsmouth (MBA). Specifically, those who have worked on the Deepwater Horizon Case study: Lim Chung Peng, Oluwafemi Akanbi, Richard Odoch, Amiel Rodriguez Adrian Nembhard, Saeed Alzahrani, Igwe Efe, Isip Ime, Shamsul Amri, Joledo Akorede, and Luwei Kenisuomo.

For Chapter 6, I am grateful to my students at both University of Manchester (MSc Reliability Engineering) and University of Portsmouth (MBA). Specifically, those who have worked on the BP Oil Refinery Disaster Case study: Mod Bin Mazid, Ken Hurley, Shehzad Khan, Akif Najafov, and Hernan Quiroz.

For Chapter 9, I am grateful to my students at both University of Manchester (MSc Reliability Engineering) and University of Portsmouth (MBA). Specifically I am grateful to the two groups involved in the Fukushima project and in particular, the leaders of the groups; Precious Katete and Michael Booth.

I am also grateful to Professor Chris Johnston and Dr. El Sobky for the valuable information and criticism they provided me with. My appreciation also goes to Dr. Martin Read for co-authoring related papers with me.

My great appreciation and thanks go to my family; my wife and my son for their patience and encouragement, without them this book would not have materialised.

Part 1

Background of Analytical Methods Used in Investigation of Disasters

Outline

Chapter 1 Introduction to the Concept of Learning from Failures

Chapter 2 Introduction to Failure Analysis Techniques in Reliability Modeling

Chapter 3 Introduction to the Analytic Hierarchy Process

Chapter 1

Introduction to the Concept of Learning from Failures

This book is about two questions—how do we learn from failures? and why do we need to learn from failures? Seemingly simple they are really quite profound and we need to dig deeper for suitable answers. Here we will introduce the concept of learning from failures by analyzing reported disasters, exploring techniques that can help us to understand the root causes of such incidents, how they unfolded over time, and how we can learn generic lessons from them.

Keywords

Learning from failures; taxonomy of theories; reliability; safety; hindsight; generic lessons

1.1 Introduction

There is evidence that lessons gained from major disasters have not really been learned by the very same organizations involved in those disasters: the multiple disasters, for example, that occurred in organizations such as NASA (the Challenger and Columbia accidents) and BP (Texas City refinery and Deepwater Horizon accidents). So why do organizations and institutions fail to learn? When accidents happen, what are the factors that can drive the unlearning process? And, how can organizations learn and change their policies, routines, and procedures through feedback? In this book, the concepts of learning and unlearning from failures are investigated and a new theory is developed in order to address these questions and to provide a mechanism for feedback. It has been reported that organizations learn more effectively from failures than from successes (Madsen and Desai, 2010) that failures contain valuable information, but that organizations vary in their ability to learn from them (Desai, 2010). It is also argued that organizations vicariously learn from the failures and near-failures of others (Kim and Miner, 2007; Madsen, 2009). However, it can also be argued that lessons gained from major failures have often not really been learned by the very same organizations involved in them. This been exemplified by recent incidents within major organizations such as BP, NASA, and Toyota.

The first case concerns BP. In March 2005, a series of explosions and fires occurred at its Texas City refinery killing 15 people and injured 170 (Vaidogas and Juocevičius, 2008). An analysis of BP’s recent history (Khan and Amyotte, 2007) showed that the March 2005 disaster was not an isolated incident and concluded that BP led the US refining industry in its incidence of fatalities over the previous decade—and in April an explosion destroyed its Deepwater Horizon drilling rig, killing 11 workers and initiating a major oil spill.

The second case concerns NASA which experienced the Challenger launch disaster in 1986 followed by the Columbia disaster in 2003. Both failures have been analyzed (Vaughan, 1996, 2005) and attention drawn to a consistent and institutionalized practice of underestimating failures as early warning signals and having too much belief in the track record of past successful launches. It was also noted that NASA concluded that both accidents were attributed to failures of foresight (Smith, 2003).

The third case concerns Toyota. In January 2010, a quality problem affected Toyota which led to a global recall, of more than 8.5 million vehicles, to deal with various problems, including sticking gas pedals, braking software errors, and defective floor mats. And again, on July 5, 2010, Toyota began recalling more than 90,000 luxury Lexus and Crown vehicles in Japan as part of a global recall regarding defective engines (Kageyama, 2010).

The author has coauthored a paper entitled "Not Just Rearranging the Deckchairs on the Titanic: Learning from Failures through Risk and Reliability Analysis" published in The Journal of Safety Science (Labib and Read, 2013), which is the first part of the title implying that learning should not lead to doing something pointless or insignificant that will soon be overtaken by events, or that contributes nothing to the solution of the current problem.

I have also written and coauthored related papers which have followed the same theme as in this present book in proposing an analytical tool or a hybrid of such tools in an integrated approach and then demonstrating the value of such an approach through a case study of a disaster or of multiple disasters. This included one (Davidson and Labib, 2003) in which we analyzed the 2000 Concorde accident using a multiple criterion prioritization approach called the analytical hierarchy process (AHP). There, we also proposed a systematic methodology for the implementation of design improvements based on experience of past failures and this has been conducted and applied in the case of the Concorde after the 2000 accident.

I have also been involved in presenting reliability engineering techniques such as failure mode effect analysis (FMEA), fault tree analysis (FTA), and reliability block diagrams (RBD) which have been used to analyze the Bhopal disaster (Labib and Champaneri, 2012) and show how such techniques can help in building a mental model of the causal effects of the disaster. The Bhopal study was also used to develop a new logic gate in the fault tree proposed for analyzing such disasters and to show the benefits of using hybrid techniques of multiple criteria and fault analysis to evaluate and prevent disasters (Ishizaka and Labib, 2013).

Four case studies of disasters from different industries have also been studied: The Titanic, Chernobyl, BP Texas city refinery, and NASA’s Columbia Shuttle (Labib and Read, 2013). The root causes of the disasters were analyzed, firstly via a description of the sequence of events that led to the disaster and then via an investigation of the technical and the logical causes of the failure as well as of its consequences. A set of 10 generic lessons was then extracted and recommendations made for preventing future system failures (Figure 1.1).

Figure 1.1 Learning from failures using systematic approaches. Papers published by the author related to this book.

So, why do failures happen? Are organizations really learning from failures? And in the context of a failure, how is learning realized? These are the questions which I shall try to address.

1.2 Why Learning from Failures?

Disasters destroy not only lives but also reputations, resources, legitimacy, and trust (Weick, 2003). It has been argued that system accident literacy and safety competence should be part of the intellectual toolkit of all engineering students (Saleh and Pendley, 2012). Safety is a fascinating and significant subject that lies across different disciplines, yet the field still suffers from fragmented literature on accident causation and system safety (Saleh et al., 2010). This is despite the existence of a set of well-developed theories in the field (Pidgeon, 1998). In learning about how to learn from failures, it is both necessary and timely to appreciate the different facets of this field. Learning, in a safety related context, is about feedback that can help us to construct mental models which in turn can lead to taking better decisions (Saleh and Pendley, 2012). A framework of the concept of learning from failures was proposed by Labib and Read (2013) which relies on three principles: (1) feedback to design, (2) use of advanced techniques for analysis, and (3) extraction of interdisciplinary generic lessons.

1.3 The Background of This Book

The book is based on material that the author has used in teaching courses on reliability and maintenance engineering at various universities for over 20 years, where the proposed models and case studies covered were presented and also draws on material from the research carried out by the author and his coauthors. I have taught Masters Programs in the field of Reliability and Maintenance at Manchester and Glasgow Caledonian Universities. The author is regularly invited to the Middle East, Europe, Canada, and the United States to speak about the recent developments of such models.

This work originated in the author’s involvement in teaching a course in Design for Maintainability, which is part of the University of Manchester’s Master Program in Reliability and Maintenance Engineering. The students, who were mainly from industry, were asked to use reliability engineering and maintenance management techniques to analyze the root causes of major machine failures, or disasters, and extract generic lessons that can feedback to design. Here, design was loosely defined to mean not just the design of particular equipment but also the design of new procedures and any recommendations that can help to prevent problems from reoccurring. This subject expanded and started to be included in industrial workshops and training as well as in MBA Master Classes that were conducted at the University of Portsmouth, UK, in the area of organizational learning from failures.

1.4 Who Should Use This Book

The book is applicable for universities at postgraduate level and to various practitioners such as safety, risk, quality, and reliability managers and officers. It is aimed at both postgraduate (PG) and senior undergraduate (U/G) students in engineering and management programs and introduces the student to the framework and interdisciplinary approach at a level appropriate to the later stages of an undergraduate program. Also, the book links theory with practice and exposes the student to the evolutionary trends in risk, safety, and reliability analyses. As a result, students after graduation should have sufficient skills to work in industry such as reliability, maintenance, safety, and quality professionals. This background will also motivate those pursuing further studies and research to consider these fields as an interesting and challenging area for their future career.

1.5 Introduction to the Concept of Learning from Failures

Questions within the process study field concern the evolutionary process, which determine how and why things emerge and develop. This is different from questions of variances, which focus on covariations among dependent and independent variables. An example of process studies at the organization level is the Balogun and Johnson (2004) research into how middle managers make sense of change as it evolves. Another example is the work of van de Ven and Poole (1995) in which the authors focus on the temporal order and sequence in which selected managerial or organizational phenomena develop and change, which contributes to the process theories of organization and management. Tsoukas and Chia (2002) suggest that processes of change are continuous and inherent to organizations. This is particular helpful when investigating how failures develop and the learning that can then occur. In this book, there is an attempt to address a strand of process studies of organizational innovation and change that examines how individuals and organizations learn from failures, and how disasters unfold over time.

Within the field of organizational learning, there is a view that incremental learning tends to be control oriented and which therefore seeks to maintain predictable operations, to minimize variation, and to avoid surprises, whereas radical learning tends to seek to increase variation in order to explore opportunities and challenge the status quo (Carroll et al., 2002). Failures are enablers for change in the status quo. They challenge the status quo and old assumptions. They force decision makers to reflect on what went wrong, why, and how (Morris and Moore, 2000).

The traditional school of thought tends to emphasize learning from successes (Sitkin, 1992; McGrath, 1999; Kim and Miner, 2000), whereas more research has begun to explore whether organizations can also learn from failures of other organizations, or from failures that occur within the same organization (Carroll et al., 2002; Haunschild and Sullivan, 2002; Denrell, 2003; Haunschild and Rhee, 2004; Chuang et al., 2007; Kim and Miner, 2007; Desai, 2008; Madsen and Desai, 2010). Experience with failure has proved to be more likely than experience with success to produce conditions for experiential learning, the driver to challenge existing knowledge, and the ability to extract meaningful knowledge from experience (Haunschild and Rhee, 2004; Madsen and Desai, 2010).

Until now, mainstream research on organizational learning has treated the impact of rare events as of only marginal interest, such events being set aside as statistical outliers (Lampel et al., 2009). However, a special issue of Organization Science in 2009 was dedicated to this topic. In this issue, Lampel et al. proposed a taxonomy of learning that was based on two categories: the impact of rare events on the organization and their relevance to that organization. Based on this, they identified four classes of events: transformative, reinterpretative, focusing, and transitory. They then mapped the works of Beck and Plowman (2009), Christianson et al. (2009), Madsen (2009), Rerup (2009), Starbuck (2009), and Zollo (2009) in to those classes. This book is about disasters that have had high impact and hence they may be regarded as either transforming or focusing, depending on their degree of relevance to a specific organization. However, there is also a provision of generic lessons that are applicable to a wide range of industries.

It is generally accepted that learning from failures is a difficult process to assess. Few authors have attempted to define it. Organizational learning has been defined by Madsen and Desai (2010) as any modification of an organization’s knowledge occurring as a result of its experience. But again it is acknowledged that a change in organizational knowledge is itself difficult to observe. Subsequently, there has been a trend in research which argues that changes in observable organizational performance reflect changes in organizational knowledge (Argote, 1999; Baum and Dahlin, 2007).

Another line of research attempts to explore ways of learning. For example, Carroll et al. (2002) proposed a four-stage model of organizational learning reflecting different approaches to control and learning. Also, Chuang et al. (2007) developed a model of learning, from the failures of health-care organizations, that highlights factors that facilitate such learning.

Learning from disasters in the context of socio-technical system failures was studied in the pioneering work of Turner (1978) on man-made disasters, by Toft and Rynolds (1997) in their identification of a topology of isomorphism, by Shrivastava et al. (1988) in their analysis of symptoms of industrial crises and their proposal of a model of socio-technical crisis causation based on either HOT event initiators of failures (human, organizational, and technological) or RIP events accelerators of failures (regulatory, infrastructural, and political). This was then extended by the work of Smallman (1996) in challenging traditional risk management models, Pidgeon and O’Leary (2000) in investigating the interaction between technology and organizational failings, and Stead and Smallman (1999) in comparing business to industrial failures, where the issue of interaction between technology and organizations was further analyzed and applied to the banking sector.

Learning from failures has been researched as an outcome rather than as a process itself. It has been argued, by Madsen and Desai (2010), that learning from failures is related to improved performance. It has also been argued by Barach and Small (2000) that learning from near-misses helps in redesigning improving processes. Learning has been defined by Haunschild and Rhee (2004) to be, in the context of car recalls, a reduction in subsequent voluntary recalls. Stead and Smallman (1999) proposed the process of a crisis as an event cycle consisting of a set of preconditions, a trigger event, the crisis event itself, and a period of recovery, which then leads to the learning phase. They attempted to ground this crisis cycle theory on the works of Turner and Pidgeon (1997), Shrivastava et al. (1988), Pearson and Mitroff (1993), and Pearson and Clair (1998).

Case studies of accidents have been presented by Kletz (2001) in an effort to learn from accidents by carrying out a thorough analysis of the causes of the failures. Therefore, the majority of the related literature, apart from that mentioned above, tends to focus on learning from failure as an outcome rather than on why disasters occur. Also, there is a lack of research work on how the learning process can emerge or on how to use models that can facilitate the process of learning from failures and extracting generic lessons. There is an argument that using a model to analyze and investigate an accident may distract people who are carrying out the investigation, as they attempt to fit the accident to the model, which may limit free thinking (Kletz, 2001). I tend to agree with this and have therefore argued here that the use of a hybrid of models overcomes this issue as such an approach will lead to limiting the assumptions inherit in such models an argument which will be enlarged upon in later chapters.

The above discussion shows that the process of learning from failures is multilayered and its understanding involves a variety of related theories. Figure 1.2, based on the research onion model of Saunders et al. (2003), shows how the scope of this book fits with respect to those theories. To summarize, the proposed approach is based on process oriented questions rather than variance questions, focuses on radical learning rather than control learning, and is based on failures rather than on successes.

Figure 1.2 Research focus. From Saunders et al. (2003).

The next section introduces a taxonomy of the theories relating to learning from failures and reviews the importance of having a balanced approach toward those theories.

1.6 Taxonomy of Theories

In the following subsections, an attempt will be made to construct a taxonomy of the various theories around learning from failures in a pair-wise style, i.e., involving the presentation of two seemingly opposed, or paradoxical, theories with respect to a certain topic that relates to safety analysis. By using such an approach, it is hoped that the reader will develop a balanced understanding of the theories, one which will enhance his skill in both formulating and analyzing the factors that have led to disasters and the issues related to lessons learned to prevent reoccurrence of any similar disasters.

1.6.1 Learning from Case Studies Versus the Narrative Fallacy Concept

Learning from reported case studies of carefully chosen major disasters is based on the arguments of Greening and Gray (1994) and Desai (2010), in that catastrophic failures are well observed and this visibility tends to encourage organizations as well as policy makers, to learn from those incidents. Although this methodology is limited by its reliance on secondary research, i.e., investigation carried out by others, it provides a fascinating body of research in that, as explained by Wood et al. (1994): "We most fully integrate that which is told as a tale." The analysis of these case studies is important for demonstrating how subjectivity that relies on the opinions of experts can be turned into a modeling approach that can ensure repeatability and consistency of results. However, one should rely, as much as possible, on facts and avoid being biased by the framing of the narrative of the case study.

The concept of the narrative fallacy was introduced by Taleb (2010) to describe how flawed stories of the past shape our views of the things around us. Narrative fallacies arise from our continuous attempt to make sense of the world. Taleb suggests that we humans constantly fool ourselves by constructing biased accounts of the past and believing they are true.