NASA, space, safety and our planet Дополнительный материал предоставлен студентами университета Ливерпуля,

• 1 слайд

  Lessons From the
  Columbia Disaster
  “Safety & Organizational Culture”
  2005 © American Institute of Chemical Engineers
  “Presentation Rev_newv4_final” as of 11_15_05
  

• 2 слайд

  FEB 1, 2003 8:59 EST
  
  All 7 astronauts are killed
  
  $4 billion spacecraft is destroyed
  
  Debris scattered over 2000 sq-miles of Texas
  
  NASA grounds shuttle fleet for 2-1/2 years
  Space shuttle Columbia, re-entering Earth’s atmosphere at 10,000 mph, disintegrates
  

• 3 слайд

  Columbia- The Physical Cause
  Insulating foam separates from external tank 81 seconds after lift-off
  Foam strikes underside of left wing, breaches thermal protection system (TPS) tiles
  Superheated air enters wing during re-entry, melting aluminum struts
  Aerodynamic stresses destroy weakened wing
  

• 4 слайд

  A Flawed Decision Process
  Foam strike detected in launch videos on Day 2
  Engineers requested inspection by crew or remote photo imagery
  to check for damage
  Mission managers discounted foam strike significance
  No actions were taken to confirm shuttle integrity or prepare contingency plans
  

• 5 слайд

  Seventeen Years Earlier…
  January 28, 1986, the shuttle Challenger explodes 73 seconds into its launch, killing all seven crew members
  
  Investigation reveals that a solid rocket booster (SRB) joint failed, allowing flames to impinge on the external fuel tank
  

• 6 слайд

  Challenger…
  Liquid hydrogen tank explodes, ruptures liquid oxygen tank
  Resulting massive explosion destroys the shuttle
  

• 7 слайд

  The Legacy of Challenger
  The Rogers Commission, which investigated the incident, determined:
  
  The SRB joint failed when jet flames burned through both o-rings in the joint
  
  NASA had long known about recurrent damage to o-rings
  
  Increasing levels of o-ring damage had been tolerated over time
  Based upon the rationale that “nothing bad has happened yet”
  
  

• 8 слайд

  The Legacy… continued
  The Commission also determined that:
  SRB experts had expressed concerns about the safety of the Challenger launch
  NASA’s culture prevented these concerns from reaching top decision-makers
  Past successes had created an environment of
  over-confidence within NASA
  Extreme pressures to maintain launch schedules
  may have prompted flawed decision-making
  The Commission’s recommendations addressed an number of organizational, communications, and safety oversight issues
  

• 9 слайд

  Columbia- The Organizational Causes
  “In our view, the NASA organizational culture had as much to do with this accident as the foam.”
  CAIB Report, Vol. 1, p. 97
  NASA had received painful lessons about its culture from the Challenger incident
  CAIB found disturbing parallels remaining at the time of the Columbia incident… these are the topic of this presentation
  
  

• 10 слайд

  Columbia Key Issues
  With little corroboration, management had become convinced that a foam strike was not, and could not be, a concern.
  
  Why were serious concerns about the integrity of the shuttle, raised by experts within one day after the launch, not acted upon in the two weeks prior to return?
  
  Why had NASA not learned from the lessons of Challenger?
  

• 11 слайд

  
  Maintain Sense Of Vulnerability
  Combat Normalization Of Deviance
  Establish an Imperative for Safety
  Perform Valid/Timely Hazard/Risk Assessments
  Ensure Open and Frank Communications
  Learn and Advance the Culture
  Key Organizational Culture Findings
  – What NASA Did Not Do
  

• 12 слайд

  Maintaining a Sense of Vulnerability
  “Let me assure you that, as of yesterday afternoon, the Shuttle was in excellent shape, … there were no major debris system problems identified….”
  NASA official on Day 8
  
  
  “The Shuttle has become a mature and reliable system … about as safe as today’s technology will provide.”
  NASA official in 1995
  

• 13 слайд

  Maintaining a Sense of Vulnerability
  NASA’s successes (Apollo program, et al) had created
  a “can do” attitude that minimized the consideration
  of failure
  Near-misses were regarded as successes of a robust system rather than near-failures
  No disasters had resulted from prior foam strikes,
  so strikes were no longer a safety-of-flight issue
  Challenger parallel… failure of the primary o-ring demonstrated the adequacy of the secondary o-ring
  to seal the joint
  A weak sense of vulnerability can lead to taking future success for granted… and to taking greater risks
  

• 14 слайд

  Combating Normalization of Deviance
  “…No debris shall emanate from the critical zone of the External Tank on the launch pad or during ascent…”
  Ground System Specification Book – Shuttle Design Requirements
  After 113 shuttle missions, foam shedding, debris impacts, and TPS tile damage came to be regarded as only a routine maintenance concern
  

• 15 слайд

  Combating Normalization of Deviance
  “This history portrays an incremental descent into poor judgment.”
  Diane Vaughan,
  The Challenger Launch Decision
  Each successful mission reinforced the perception that foam shedding was unavoidable…either unlikely to jeopardize safety or an acceptable risk
  
  Foam shedding, which violated the shuttle design basis, had been normalized
  
  Challenger parallel… tolerance of damage to the primary o-ring… led to tolerance of failure of the primary o-ring… which led to the tolerance of damage to the secondary o-ring… which led to disaster
  

• 16 слайд

  Establish An Imperative for Safety
  “When I ask for the budget to be cut,
  I’m told it’s going to impact safety on
  the Space Shuttle … I think that’s a
  bunch of crap.”
  Daniel S. Goldin,
  NASA Administrator, 1994
  
  The shuttle safety organization, funded by the programs it was to oversee, was not positioned to provide independent safety analysis
  The technical staff for both Challenger and Columbia were put in the position of having to prove that management’s intentions were unsafe
  
  This reversed their normal role of having to prove
  mission safety
  

• 17 слайд

  Establish An Imperative for Safety
  International Space Station deadline 19 Feb 04
  Desktop screensaver at NASA
  As with Challenger, future
  NASA funding required
  meeting an ambitious launch
  schedule
  
  Conditions/checks, once
  “critical,” were now waived
  
  A significant foam strike on a recent mission was not resolved prior to
  Columbia’s launch
  
  Priorities conflicted… and production won over safety
  

• 18 слайд

  Perform Valid/Timely
  Hazard/Risk Assessments
  “Any more activity today on the tile damage or are people just relegated to crossing their fingers and hoping for the best?”
  Email Exchange at NASA
  
  “… hazard analysis processes are applied inconsistently across systems, subsystems, assemblies, and components.”
  CAIB Report, Vol. 1, p. 188
  NASA lacked consistent, structured approaches for identifying hazards and assessing risks
  Many analyses were subjective, and many action items from studies were not addressed
  In lieu of proper risk assessments, many identified concerns were simply labeled as “acceptable”
  Invalid computer modeling of the foam strike was conducted by “green” analysts
  

• 19 слайд

  Ensure Open and Frank Communications
  I must emphasize (again) that severe enough damage… could present potentially grave hazards… Remember the NASA safety posters everywhere around stating, “If it’s not safe, say so”? Yes, it’s that serious.
  Memo that was composed but never sent
  Management adopted a uniform mindset that foam strikes were not a concern and was not open to contrary opinions.
  The organizational culture
  Did not encourage “bad news”
  Encouraged 100% consensus
  Emphasized only “chain of command” communications
  Allowed rank and status to trump expertise
  
  

• 20 слайд

  Ensure Open and Frank Communications
  Lateral communications between some NASA sites were also dysfunctional
  
  Technical experts conducted considerable analysis of the situation, sharing opinions within their own groups, but this information was not shared between organizations within NASA
  
  As similar point was addressed by the Rogers Commission on the Challenger incident
  Management pushback can discourage, even intimidate, those seeking to share concerns.
  

• 21 слайд

  Learn and Advance the Culture
  CAIB determined that NASA had not learned from the lessons of Challenger
  Communications problems still existed
  Experts with divergent opinions still had difficulty getting heard
  Normalization of deviance was still occurring
  Schedules often still dominated over safety concerns
  Hazard/risk assessments were still shallow
  Abnormal events were not studied in sufficient detail, or trended to maximize learnings
  
  

• 22 слайд

  … An Epilog
  Shuttle Discovery was launched on 7/26/05
  NASA had formed an independent Return To Flight (RTF) panel to monitor its preparations
  7 of the 26 RTF panel members issued a minority report prior to the launch
  
  Expressing concerns about NASA’s efforts
  Questioning if Columbia’s lessons had been learned
  
  

• 23 слайд

  … An Epilog
  During launch, a large piece of foam separated from the external fuel tank, but fortunately did not strike the shuttle, which landed safely 14 days later
  The shuttle fleet was once again grounded, pending resolution of the problem with the external fuel tank insulating foam
  
  

• 24 слайд

  
  
  
  Turning Inward
  - Our Industry -
  

• 25 слайд

  Piper Alpha
  On 7/6/1988, a series of explosions and fires destroyed the Piper Alpha oil platform
  165 platform workers and 2 emergency responders were killed
  
  61 workers survived by jumping into the North Sea
  

• 26 слайд

  The Physical Cause
  
  It is believed that a pump had been returned to service with its discharge relief valve removed for testing
  The light hydrocarbon (condensate) that was released formed a vapor cloud and ignited
  The resulting vapor cloud explosion ruptured oil export lines and ignited fires on the platform
  
  

• 27 слайд

  The Physical Cause
  Other interconnected platforms continued production, feeding the leaks on Piper Alpha
  Ensuing fires breached high pressure natural gas inlet lines on the platform
  The enormity of the resulting conflagration prevented any organized evacuation
  
  

• 28 слайд

  The Organizational Causes
  The official investigation report, written by Lord Cullen, faulted the company’s management of safety on Piper Alpha
  The confusion leading to restarting the condensate pump resulted from failures to adhere to the permit to work (PTW) system
  Daily monitoring and periodic audits had failed to identify the continuing dysfunction of the system
  

• 29 слайд

  The Organizational Causes
  Inadequate shift turnovers failed to communicate the status of the pump to the oncoming shift
  Inadequate communications (and PTW system problems) had contributed to a fatality, and a civil conviction for the company, but remedial action had not been taken
  The diesel fire pumps were in manual and, after the explosion, could not be reached by staff seeking to start them
  A prior audit recommendation to stop this practice had not been implemented
  
  

• 30 слайд

  The Organizational Causes
  Even if fire water had been available, many deluge nozzles were plugged
  The company had been trying to resolve this problem for at least four years, but repairs were behind schedule
  
  One year earlier, an engineering study had concluded that the gas risers were vulnerable and that a massive gas release could prevent successful evacuation of
  the platform
  Management had discounted the study results
  

• 31 слайд

  The Organizational Causes
  Other problems that audits and management reviews had failed to identify and/or resolve included:
  Emergency response training given to workers new to the platform was cursory and often omitted. Some workers had not been shown the location of their life boat.
  
  Platform managers had not been trained on how to respond to emergencies on other platforms (e.g., when to stop production)
  
  Evacuation and emergency shutdown drills on Piper Alpha were not conducted according to schedule
  
  
  

• 32 слайд

  Parallels to NASA and Columbia
  Each Piper Alpha organizational cause can be mapped to one or more of the NASA lessons
  Maintain Sense Of Vulnerability
  Combat Normalization Of Deviance
  Establish an Imperative for Safety
  Perform Valid/Timely Hazard/Risk Assessments
  Ensure Open and Frank Communications
  Learn and Advance the Culture
  

• 33 слайд

  Flixborough
  On 6/1/1974, a massive vapor cloud explosion (VCE) destroyed a UK chemical plant
  Consequences:
  28 employees died and 36 were injured
  
  Hundreds of off-site injuries
  
  Approx. 1800 homes and 170 businesses damaged
  

• 34 слайд

  The Physical Cause
  Approx. 30 tons of boiling cyclohexane released from reactor system
  Most likely release cause was the failure of a temporary piping modification
  Installed between two reactors
  Was a bypass for reactor removed for repairs
  

• 35 слайд

  The Physical Cause
  Bellows not designed for 38-ton thrust
  Design standards for bellows ignored
  Inadequate pressure test of installation
  Inadequate vertical and lateral support for jumper
  

• 36 слайд

  The Organizational Causes
  No qualified mechanical engineer on-site
  Inadequate concern with the cause of the reactor failure
  Jumper connection considered a routine plumbing job
  No detailed design for jumper
  
  

• 37 слайд

  The Organizational Causes
  “Hurry up”
  attitude of management
  
  Overworked staff did not take time to properly analyze their actions
  

• 38 слайд

  Parallels to NASA and Columbia
  Each Flixborough organizational cause can be mapped to one or more of the following NASA lessons
  Maintain Sense Of Vulnerability
  
  Establish an Imperative for Safety
  
  Perform Valid/Timely Hazard/Risk Assessments
  

• 39 слайд

  Could this happen to us?
  Optional: Paste Company logo here
  Complacency due to our superior safety performance
  Normalizing our safety critical requirements
  Ineffective Risk Assessments of our systems
  Reversing the Burden of Proof when evaluating safety of operations
  Employees Not Speaking Freely of their safety concerns
  Business Pressures at odds with safety priorities
  Failure to Learn and apply learnings to improving our culture
  

• 40 слайд

  Title for Relevant Company Event
  Use this section to briefly summarize key aspects of the event
  Do not addresses causes here
  Add additional slides if required
  Paste photo related to event in space at right, if desired
  JPG files at 300 dpi, provide adequate resolution
  If photo is not provided, drag right border over to expand this text box
  Optional: Paste Company logo here
  

• 41 слайд

  The Physical Cause
  Briefly describe the factors that caused the event
  Do not address organizational factors here
  Add additional slides if required
  Add photo to the right, or expand the text box as desired/needed
  
  Optional: Paste Company logo here
  

• 42 слайд

  The Organizational Causes
  Describe the organizational causes of the event
  
  Where feasible, lay a basis for parallels to the 6 NASA organizational culture findings
  
  Maintain Sense Of Vulnerability
  Combat Normalization Of Deviance
  Establish an Imperative for Safety
  Perform Appropriate and Timely Hazard/Risk Assessments
  Ensure Open and Frank Communications
  Learn and Advance the Culture
  
  Optional: Paste Company logo here
  

• 43 слайд

  Parallels to NASA and Columbia
  If you feel that this would add to the emphasis of the message, include one or more slides that emphasize how your organizational causes relate to the underlying themes from Columbia
  Alternatively, you may want to leave this as an individual or group exercise for the audience
  Optional: Paste Company logo here
  

• 44 слайд

  
  
  
  Indicators Of Organizational Culture Weaknesses
  The following slides provide examples of indicators that your organization is…
  

• 45 слайд

  …NOT Maintaining a
  Sense of Vulnerability
  Safety performance has been good… and you do not recall the last time you asked “But what if…?”
  You assume your safety systems are good enough
  You treat critical alarms as operating indicators
  You allow backlogs in preventative maintenance of critical equipment
  Actions are not taken when trends of similar deficiencies are identified.
  
  

• 46 слайд

  …NOT Preventing
  Normalization of Deviance
  You allow operations outside established safe operating limits without detailed risk assessment
  Willful, conscious, violation of an established procedure is tolerated without investigation, or without consequences for the persons involved
  Staff cannot be counted on to strictly adhere to safety policies and practices when supervision is not around to monitor compliance
  You are tolerating practices or conditions that would have been deemed unacceptable a year or two ago
  
  

• 47 слайд

  …NOT Establishing An
  Imperative for Safety
  Staff monitoring safety related decisions are not technically qualified or sufficiently independent
  Key process safety management positions have been downgraded over time or left vacant
  Recommendations for safety improvements are resisted on the grounds of cost or schedule impact
  No system is in place to ensure an independent review of major safety-related decisions
  Audits are weak, not conducted on schedule, or are regarded as negative or punitive and, therefore, are resisted
  

• 48 слайд

  …NOT Performing Valid/Timely
  Hazard/Risk Assessments
  Availability of experienced resources for hazard or risk assessments is limited
  Assessments are not conducted according to schedule
  Assessments are done in a perfunctory fashion, or seldom find problems
  Recommendations are not meaningful and/or are not implemented in a timely manner
  Bases for rejecting risk assessment recommendations are mostly subjective judgments or are based upon previous experience and observation.
  

• 49 слайд

  …NOT Ensuring Open and
  Frank Communications
  The bearer of “bad news” is viewed as “not a team player”
  Safety-related questioning “rewarded” by requiring the suggested to prove he / she is correct
  Communications get altered, with the message softened, as they move up or down the management chain
  Safety-critical information is not moving laterally between work groups
  Employees can not speak freely, to anyone else, about their honest safety concerns, without fear of career reprisals.
  
  

• 50 слайд

  …NOT Learning and Advancing
  the Culture
  Recurrent problems are not investigated, trended, and resolved
  Investigations reveal the same causes recurring time and again
  Staff expresses concerns that standards of performance are eroding
  Concepts, once regarded as organizational values, are now subject to expedient reconsideration
  
  

• 51 слайд

  “Engineering By View Graph”
  “When engineering analyses and risk assessments are condensed to fit on a standard form or overhead slide, information is inevitably lost… the priority assigned to information can be easily misrepresented by its placement on a chart and the language that is used.”
  CAIB Report, Vol. 1, p. 191
  The CAIB faulted shuttle project staff for trying to summarize too much important information on too few PowerPoint slides
  We risk the same criticism here
  This presentation introduces the concept of organizational effectiveness and safety culture, as exemplified by the case studies presented
  This is only the beginning…