Four layers. A disaster passes through all of them.
When something terrible happens at work, the first story is always one person's mistake. It is almost never the true story. Picture a workplace's safety as layers: the hazard found, a control on it, somebody checking, warnings heard. A fault has to pass through all of them. This course has been one layer per chapter.
Rana Plazaapproved for shops
++
Five garment factoriesthousands of machines
++
Generatorson the upper floors
Rana Plaza was an eight-storey building near Dhaka, in Bangladesh, approved for shops and offices. Its upper floors had been added without permission, and five garment factories moved in: thousands of sewing machines, and heavy diesel generators on the upper floors to run them when the power failed. The building was carrying a load it was never built for.
Hazard foundlesson four
↓→
Control in placelesson five
↓→
Checkedlesson six
↓→
Warning heardlesson seven
Which layer was missing first at Rana Plaza, before anything cracked?
Hazard found. Nobody treated a building carrying factories it was not built for as a hazard at all.
Right. The first layer is seeing the thing that could cause harm. A shop building holding generators and five factories is a hazard anyone doing step one of lesson four would have written down.
Warning heard. The cracks were ignored.
Not yet. They were, and that is the last layer to fail. The first layer failed years earlier, when the floors went on and nobody asked what they would carry.
Checked. Nobody inspected the generators.
Not yet. Checking is a layer that comes later. Before anyone could check a control, somebody had to see the hazard and put a control on it, and neither happened.
23 AprilCracks found
↓→
24 April, morningWorkers told to return
↓→
about 9 am; 1,134 diedCollapse
On 23 April 2013 cracks appeared in the walls. The shops and the bank on the lower floors closed. The garment factories told their workers to come back the next morning; some were told they would lose a month's pay if they did not. Just before nine, the power failed, the generators started, and the building fell. 1,134 people died.
Put the chain that led to Rana Plaza in order.
Tap them in order, first to last.
Floors added→Load moved in→Cracks→Told to return→Collapse
Right. Each link needed the one before it. The floors made the load possible, the load made the cracks, the cracks were a warning, and the order to return is what turned the warning into a death toll. Remove any one link and the morning is different.
Four layers, and all four failed at Rana Plaza. Tap the one that failed last, on the morning itself.
Tap the part of the picture that answers it.
Hazard foundlesson four
↓→
Control in placelesson five
↓→
Checkedlesson six
↓→
Warning heardlesson seven
Warning heard
Right. The cracks were found, the bank believed them, and the factories did not. A warning that is seen and overruled is the last layer there is, and it failed with a day to spare.
Hazard found
Not yet. This layer failed first, years before, when floors went on a shop building and nobody asked what they would hold.
Control in place
Not yet. No control was ever put on the load: no engineer's limit, no rule about what went on which floor. This layer was never there to fail on the morning.
Checked
Not yet. An inspection that read the building against what it was approved for would have stopped it years earlier. That check never happened, so this layer failed long before the morning.
Permit onevalve removed
↓→
Permit twopump restarted
↓→
Piper Alpha167 died
The same shape appears in every trade. Piper Alpha was a North Sea oil platform. On 6 July 1988 a pump's safety valve was taken off for repair under one permit. The night shift, working from another permit, did not know, and restarted the pump. 167 men died. Both papers were correct. They never spoke to each other.
Move the control to add layers between a fault and the people. Picture each layer stopping nine faults in ten, a made-up round number, with 10,000 faults a year.
10,000Faults
↓→
0Layers
↓→
10,000Reach the people
0 layersNo layers. Every fault that happens reaches the people, and the first warning is the harm.
10,000Faults
↓→
1Layers
↓→
1,000Reach the people
1 layer1 layer, stopping nine faults in ten. Of 10,000 faults, 1,000 get through: 1 fault in 10 reaches the people.
10,000Faults
↓→
2Layers
↓→
100Reach the people
2 layers2 layers, each stopping nine faults in ten. Of 10,000 faults, 100 get through: 1 in 100. The layers only work if each one is really there on the day.
10,000Faults
↓→
3Layers
↓→
10Reach the people
3 layers3 layers, each stopping nine faults in ten. Of 10,000 faults, 10 get through: 1 in 1,000. The layers only work if each one is really there on the day.
10,000Faults
↓→
4Layers
↓→
1Reach the people
4 layers4 layers, each stopping nine faults in ten. Of 10,000 faults, 1 gets through: 1 in 10,000. The layers only work if each one is really there on the day.
With three layers, 10 faults in 10,000 get through. Rana Plaza had four layers on paper. What does the model say about a disaster that still happened?
That the layers were not really there. A layer that exists on paper and fails on the day stops nothing.
Right. The arithmetic assumes each layer works nine times in ten. A check nobody does, and a warning nobody heeds, work zero times in ten. The model counts the layers that are there, not the ones written down.
That it was the one-in-ten-thousand bad luck.
Not yet. Bad luck is what you call a fault that beats four working layers. Rana Plaza's layers did not work and lose; they were absent. Cracks found and overruled is not a layer failing by chance.
That more layers would have made no difference.
Not yet. Four working layers let one fault in 10,000 through. The difference is between a layer that works and a layer that is a line on a form, not between four and five.
Move the control.
Mixerguard off two weeks
↓→
Two colleaguesmentioned it
↓→
A finger lost
A made-up headline: Bakery worker loses a finger in a mixer. The guard had been off for two weeks for cleaning. Two colleagues had mentioned it. Which layers failed?
Three. The control came off and stayed off, nobody's check found it in two weeks, and two warnings were heard and not acted on.
Right. The hazard was known; a guard had been fitted. Then the control layer, the checking layer and the warning layer all failed, one after the other, and the finger is what came through all three.
One. Whoever took the guard off is to blame.
Not yet. Taking a guard off to clean is normal. Not putting it back, nobody noticing for two weeks, and two reports going nowhere are three separate failures, and blaming the cleaner fixes none of them.
One. The worker should have kept their hand out of the mixer.
Not yet. That is the first story, and it is the story that keeps the layers broken. A guard exists because hands go near blades; its job was to be there on the day a hand did.
Lesson complete
A disaster is a fault that passed through every layer; blaming one person is how the layers stay broken.