UNIVERSITY OF CALIFORNIA, BERKELEY BERKELEY • DAVIS • IRVINE • LOS ANGELES • MERCED • RIVERSIDE • SAN DIEGO • SAN FRANCISCO Root Causes Analyses of the Oroville Dam Gated Spillway Failures and Other Developments Robert G. Beaa Emeritus Professor, Department of Civil & Environmental Engineering Advisor, Center for Catastrophic Risk Management Oroville Dam Advisory Group University of California Berkeley Tony Johnsonb Center for Catastrophic Risk Management Oroville Dam Advisory Group University of California Berkeley July 20, 2017 a Summary background available at https://drive.google.com/open?id=0Bz1I1mIutSEnd05fWUNlVXcyWFk Additional background available at - http://www.mensjournal.com/magazine/bob-bea-the-master-of-disaster-20130225 and http://discovermagazine.com/2013/june/14-master-of-disaster b  Summary     background available at  https://drive.google.com/open?id=0Bz1I1mIutSEneTN6YlNKRVdZcGs   1 Introduction We have performed forensic Root Causes Analyses of the Oroville Dam Gated Spillway failures and other associated developments as unfunded (approximately 3,000 pro-bono hours) volunteers of the University of California at Berkeley (UCB) Center for Catastrophic Risk Management (CCRM) Oroville Dam Advisory Group (ODAG). We initiated this work on January 27, 2017. The results contained in this report have been developed based on the currently available public document and information sources cited at the end of this report, included in the Preliminary Root Causes Analysis of the Failures of the Oroville Dam Gated Spillway report dated April 17, 2017, and in the Legislative Oversight Report: Oroville Dam report dated May 11, 2017. c, 1 This report documents our analyses of the Root Causes of the initial failure of the Gated Spillway. Appendix A of this report provides summaries of the procedures and processes we used to perform the Root Causes analyses, background on the components that comprise Engineered Systems, and background on the Human and Organizational Factor malfunctions (errors) responsible for failures of Engineered Systems. Appendix B provides details of our analyses of the Physical and Organizational Root Causes of the initial failure of the Gated Spillway. The opinions expressed in this Report are ours alone. The opinions expressed herein are a fair and accurate summary of our opinions, based upon our experience, education, training, and expertise. Robert Bea and Tony Johnson c  References  cited  are  included  in  the  References  Section  at  the  end  of  this  report  together  with  Google   Document  links  to  archived  copies  of  the  available  cited  documents.   1 Acknowledgements In January 2006, Professor Raymond Seed and the first author of this report co-founded the UCB CCRM.d CCRM was formed as a multi-disciplinary, multi-campus research and development center that focused on prevention and mitigation of major failures involving engineered infrastructure systems. Starting in 2009, CCRM served as the focal point for a Research and Development Project sponsored by the National Science Foundation identified as the RESIN (Resilient and Sustainable Infrastructure Systems) Project.e This project developed, validated, and applied advanced System Risk Assessment and Management (SRAM) to the California Delta Infrastructure Systems.f During this 6-year duration project, specific infrastructure systems located in the California Delta (e.g. flood protection, emergency evacuation, Sherman Island, Natomas Basin) were studied to determine the risks associated with extreme condition storms based on 2010 and 2100 environmental conditions (including projected global climate changes).g Results from the RESIN project provided important starting points for this investigation. During May 2017, the UCB CCRM Executive Director, Dr. Rune Storesund, initiated formation of the Oroville Dam Advisory Group (ODAG). The UCB CCRM ODAG was formed to provide a public source of information on the developments associated with the failures and potential developing failures of different components in the Oroville Dam System. This work included development of specific short-term and long-term recommendations for ‘going forward.’ Currently, the UCB CCRM ODAG has 15 members that include senior academic faculty, citizens concerned with the Oroville Dam developments, retired California Department of Water Resources (DWR) managers, engineers, and operators, and local business, environmental and government group representatives.h d  CCRM  background  available  at  http://ccrm.berkeley.edu/     e  CCRM  National  Science  Foundation  sponsored  RESIN  project  background  available  at   http://ccrm.berkeley.edu/resin/     f  Detailed  descriptions  of  System  Risk  Assessment  and  Management    processes,  approaches,  and  analytical   formulations  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEnUEJtbmluSVVCa0U  and   https://drive.google.com/open?id=0Bz1I1mIutSEnTFVkaDUxLTNYZ2M     g  Products  (documents,  reports,  videos)  developed  by  the  RESIN  project  are  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnOEV1TkFxS2JsZFU     https://drive.google.com/open?id=0B0_jjqbhy5meOENOSzRGbTVJNFU   https://drive.google.com/open?id=0Bz1I1mIutSEnclRwVGNHanVfb1U   https://drive.google.com/open?id=0Bz1I1mIutSEnanczemd2MDBySXc   https://drive.google.com/open?id=0Bz1I1mIutSEnekIySnZnOHJkWWM     https://drive.google.com/open?id=0Bz1I1mIutSEnX3gyN2FpWjE3NGc     h  Current  list  of  CCRM  ODAG  members  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnWUpfZWkxU0NmOTQ     2 Since early February, we have received significant inputs from many retired former California Department of Water Resources (DWR) Division of Engineering engineers, Operations and Maintenance engineers, and former DWR operators and managers. These individuals were and still are highly respected, and experienced in design, construction, operations, and maintenance (O&M) of the California State Water Project (SWP) facilities, and in developing preparations for and responding to SWP emergencies assisted by the California Governor’s Office of Emergency Services (Cal OES). These individuals received Director level recognition and awards from the cited State organizations. At this time, with one exceptioni, these people have requested their names not be made public to help preserve their privacy. These people willingly volunteered their knowledge, experience, documentation, and advice as very important resources that have been integrated into this report. These people have demonstrated consistently their desire to contribute in positive ways to realization of two primary Objectives: 1) attempting to help improve the management, engineering, and operations of DWR, and 2) encourage the State help DWR secure other essential resources needed to develop, maintain, and improve DWR and SWP operations and the results from those operations. The ultimate Goal of these two Objectives has been to help re-establish and advance DWR and the Division Of Safety of Dams (DSOD) and the associated responsible State and Federal agencies groups (e.g. State Water Contractors) capabilities to provide for the reliable delivery of a vital resource – water, and to contribute to provision of associated Infrastructure Systems,j such as those for Flood Protection, that are able to provide essential public infrastructure services having desirable Safety,k,2 As Low As Reasonably Practicable (ALARP) Risksl, and Qualitym performance characteristics for the citizens of the State of California. i  updated  Don  Colson  report  on  Emergency  Spillway  use  disastrous  decisions  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnZGFlNzhoS2tvMkU     j  Systems  -­‐  Interconnected,  interactive,  interdependent  Human,  Organization,  Hardware,  Structure,   Environment,  Guidelines,  Standards,  Procedures  and  Processes  and  Interfaces  between  the  foregoing   Components.   k  Safety  –  Freedom  from  undue  exposure  to  injury  and  harm  including  capabilities  to  deliver  ALARP  Risks.   For  more  background:  https://drive.google.com/open?id=0Bz1I1mIutSEnbUgwUXZ6WXlYMmc   https://drive.google.com/open?id=0Bz1I1mIutSEnUkpQcXRGQklDbHM   l  ALARP  Risks  –  Combinations  of  the  Likelihoods  and  Consequences  of  major  infrastructure  System  failures  –   Risks  -­‐  that  are  As  Low  As  Reasonably  Practicable  (ALARP)  based  on  Historic,  Current  Standards  of  Practice,   and  Monetary  short-­‐term  and  long-­‐term  present-­‐valued  Costs  (direct,  indirect,  current,  future)  –  Benefit   (failures  prevented  and  mitigated,  decreases  in  Likelihoods  and  Costs)  analyses  and  assessments.   m  Quality  –  combination  of  public  infrastructure  system  Serviceability  (provide  important  resources  and   services),  Safety,  ALARP  Risks,  Durability  (freedom  from  undesirable,  undetected,  and  un-­‐remediated   degradation  in  System  Quality  performance  characteristics)  and  Compatibility  (freedom  significant  negative   impacts  on  the  environment,  public,  commerce  and  industry,  and  government).   3 Of particular importance to this phase of our investigation is the report written by two members of the CCRM ODAG that summarizes The “Watering Down” of the Department of Water Resources Division of Safety of Dams.n This report summarizes DWR and DOSD multi-decade progressive ‘Losses of Core Competencies’ and contains recommendations for DWR – DSOD re-organization, management, operations, maintenance, and engineering resources and oversight. In addition, we have received important inputs, guidance, and other resources to help develop our understanding of the circumstances and factors that were operative during development of the Oroville Dam Spillway failures from two organizations and groups of concerned citizens who established, operated, maintained, and continue to develop internet Group Communication web sites: 1) Metabunk.orgo and 2) FreeRepublic.comp. These two groups continue to develop important information and insights we have attempted to properly interpret and integrate into this report. We have compiled a series of discussions previously posted on FreeRepublic.com that have particular importance in this phase of our investigation. This compilation is provided in this report as a single down-loadable reference.q The major issues addressed in this series are: 1) DWR's decision to Split the Spillway design in 1960's - Politics of Engineering Judgment: How Failure is introduced - #2596 2) Cracked Anchor Tendons & Failures, FERC, DWR engineering data conflicts & changing definitions, unknowns of tendons - #3334 3) DSOD Inspector "unloads" in report - DWR's indifference to maintenance - DWR using seepage flow as "crude" replacement for lost Piezometers - #3675 4) Headworks design flaw - Shear cracking in Pier Columns - Risk to FCO gate structures differential settlement of bridge lift footing - #3703 5) Large Concrete Block formation by DWR in "deep void" filling - erosion forming voids drain pipe dropping & clogging by concrete/grout entering drain lines -tree roots - #3704 6) DSOD Inspector report notes that known defective areas in spillway repairs will be performed only after damage from heavy flows - #3707 7) FERC issues a long list of corrections to DWR on Quality Control Inspection Program (QCIP). Demonstrates lack of engineering experience by DWR on QCIP - #3778 8) Radial Gate Side Seal Assembly issues - design flaws? - excessive leakage of side seals deemed "normal" by DSOD - susceptible to debris jamming? - divers removing wedged debris to open gates - #3846/3847 n  The  “Watering  Down”  of  the  Department  of  Water  Resources  Division  of  Safety  of  Dams  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnUks4T3ljdjJLcWs   o  Metabunk.Org  ,accessible  at:  https://www.metabunk.org/forums/OrovilleDam/ p  Free  Republic.Com,  accessible  at:   http://www.freerepublic.com/focus/search?q=quick&m=all&o=time&s=Oroville+Dam&find=Find  and   http://www.freerepublic.com/focus/news/3524221/posts?q=1&;page=1#1   q  Compiled  Free  Republic  Oroville  Dam  spillway  failures  discussions  available  at  https:   https://drive.google.com/open?id=0Bz1I1mIutSEnZ1BDXzAwZS12cDA   4 9) Water Vortex in front of Emergency Spillway noted & photographed by DSOD - withheld this information in public reports - discrepancy Found in FERC Performance Review document - why keep from public? - #3862 10) DWR Organizational Ethics - Engineering Incompetence or Engineering Deception Flawed information - Press Releases, Town Halls, Press interviews, Legislative Testimony - #3903 11) New Oroville Spillway 1:50 Model testing - Scalability issues - Forensic Team "stalling"? Politics? - Suggested Forensic Team HOF issues to investigate - #3924 12) Former DSOD Chief admits "Maybe we did miss it" (signs to spillway failure) - points to Forensic Team to give an answer - "maybe" verses "Known or Unknown" - #3931 13) DWR twisting BOC's comments? Turning them into "conclusions"? Highly Misleading? -Preemptive strike to mute intentional use of "fill material" in building of spillway? #4012 Of particular importance to this phase of our investigation is a series of ten (10) reports authored by the second author of this report. These reports address four categories of ‘breakdowns’ associated with the Oroville Dam ‘System’:r 1) Persistent existing ‘Leaks’ and ‘Wet Spots’ on and around the dam (Reports 1 – 4), 2) Persistent existing ‘Cracks’ in the Gated Spillway Headworks reinforced concrete supporting structure and broken and cracked gate anchor ‘tendons’ (Reports 6, 7, 10), 3) Progressive failures of the Gated Spillway and historic ‘patchwork’ repairs (Reports 5, 8), and 4) DWR – DSOD mis-management ‘liabilities’ (Report 9). Summary of Conclusions The flaws and defects incorporated into the Oroville Dam Gated Spillway represent accumulated results from the Gated Spillway’s Life-Cycle Phases (1965 to February 2017). The Life-Cycle defects include those developed during Design, Construction, Operations and Maintenance (O&M) Phases. Of particular importance in this Root Causes investigations were the Standards, Guidelines, procedures and processes used by the California Department of Water Resources (DWR) and the associated Division of Safety of Dams (DSOD) during the life-cycle phases of the Gated Spillway. The California Code of Regulations and The California Water Code charge DWR and DSOD with primary responsibilities and accountabilities for specified State Water Supply dams and reservoirs during their lives: “…as to the Safety of design, construction, maintenance, and operation of any dam or reservoir.” t r  Compiled  reports  1  –  10  authored  by  Tony  Johnson  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnR3U4QVY2TFRWLWc     s  See  Appendix  A  pages  1-­‐4  for  background  on  performance  of  Root  Causes  Analyses.   t A  compiled  summary  of  DWR  –  DOSD  responsibilities,  accountabilities  and  practices  is  available  at     https://drive.google.com/open?id=0Bz1I1mIutSEnWTJsM2Q4V0F3MTA 5 In the April 17th Preliminary Root Causes Analysis reportu and the May 11th Legislative Oversight Testimony reportv, specific defects and flaws in the Gated Spillway were cited and described that could be identified and corroborated based on the photographic evidence and documentation referenced in those reports’ references. A summary of the analyses of the physical causes of the initial failure in the Gated Spillway was provided. Our Root Causes Analyses investigations have concluded the physical effects of the life-cycle flaws and defects incorporated into the Gated Spillway were highly interactive and cumulative. The interactions resulted in progressive deterioration of the performance abilities of the Gated Spillway and resulted in reduction of its Safety and increases in its Risk of failure. This process continued until the Gated Spillway failed during the early February 2017 Oroville Dam reservoir discharges. Our Root Causes Analyses investigations have concluded that 'inappropriate'w standards and guidelines, procedures and processes were used by the Department of Water Resources (DWR) and the associated Division of Safety of Dams (DSOD) to evaluate and manage the Riskx of failure characteristics of the Gated Spillway. These standards and guidelines, procedures and processes failed to adequately and properly address Aging, Technological Obsolescence, and Increased Risk of failure characteristics of the Orville Dam Gated Spillway. Due to the multi-decade ‘Loss of Core Competencies’, the management of DWR and DSOD failed to provide adequate Management (planning, organizing, leading, controlling), Engineering, Operations, and Maintenance personnel ‘skills, knowledge and performance capabilities’ and other important ‘resources’ required to effectively prevent and mitigate the failures of the Gated Spillway.m The Gated Spillway was ‘managed to failure’ by DWR and DSOD. In addition, the available evidence indicates validation and approval of the long-term continued use of these ‘inappropriate’ standards, guidelines, procedures and processes was provided by the Federal Energy Regulatory Commission (FERC). The Gated Spillway was ‘regulated to failure’ by FERC. We have received ‘redacted’ reports released by the DWR Board of Consultants (BOC)y and the DWR Forensic Engineering Team (FET),z and by the U.S. Army Corps of Engineers (USACE)   u  Report  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEnSUY5WjluQmhPXzg     v  Report  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEnWHozRUsyNFl1Y2c     w  ‘Inappropriate’  –  intentional  deviations  from  mandated  acceptable  practice  Standards  and  Guidelines.   x  Risk  –  Likelihood  and  Consequences  associated  with  major  failures  of  an  Engineered  System.   y Reports  available at https://drive.google.com/open?id=0Bz1I1mIutSEnOXdGMU1Ob0JGcFE https://drive.google.com/open?id=0Bz1I1mIutSEnWXB4NVNRVUhsR1U https://drive.google.com/open?id=0Bz1I1mIutSEnT3ZDcll6NDZkRnM z  Report  available  at  https://drive.google.com/open?id=0B0_jjqbhy5meVEpjR1RlZExBR1E   6 Institute for Water Resources Risk Management Center.aa Also, we have received a report written by Bernard Goguel that provides a summary of his analyses of the initial failure in the Gated Spillway.bb Our reviews of the physical causes related to design, construction, operation and maintenance of the Gated Spillway identified in these reports leads us to conclude these findings substantially corroborate those identified in the April 17th Preliminary Root Causes investigation report, summarized in the May 11th Summary and Recommendations report and in this report. These additional reports have provided important additional details and background on the life-cycle Physical Root Causes of the Gated Spillway failures. Summary of Gated Spillway Defects, Flaws, Development of Initial Failure, and Root Causes The following sections summarize the Gated Spillway’s physical defects and flaws, initial failure, and Root Causes of this failure identified during this investigation. The evidence (documentation and photographic) to support these identifications are cited in each of the following sub-sections and the References Section of this report: Design1,3 1. Spillway base slabs of insufficient thickness for the design hydraulic conditions: 4 to 6 inches thick at minimum points; 2. Spillway base slabs not joined with 'continuous' steel reinforcement to prevent lateral and vertical separations; 3. Spillway base slabs designed without effective water stop barriers embedded in both sides of joints to prevent water intrusion under the base slabs; 4. Spillway base slabs not designed with two layers of continuous steel reinforcement (top and bottom) to provide sufficient flexural strength required for operating conditions; and 5. Spillway base slabs designed with ineffective ‘ground’ anchors to prevent significant lateral and vertical movements. Construction1,4 1. Failure to excavate the native soils and incompetent rock overlying the competent rock foundation assumed as a basic condition during the spillway design phase, and fill the voids with concrete, and 2. Failure to prevent spreading gravel used as part of the under-slab drainage systems and ‘native’ soils to form extensive 'graded blankets' of permeable materials in which water could collect and erode.   aa  Report  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEnN2V2VnJ2cVhJWVE     bb  Report  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEncnVEUktrQkNjRms     7 Operations & Maintenance1,5 3. Repeated ineffective repairs made to cracks and joint displacements to prevent water stagnation and cavitation pressure induced water intrusion under the base slabs with subsequent erosion of the spillway subgrade, and in some cases, to effectively ‘plug’ and severely decrease water flow through the spillway drains; and 4. Allowing large trees and other vigorous vegetation to grow adjacent to the spillway walls whose roots could intrude below the base slabs and into the subgrade drainage pipes resulting in reduced flow and plugging of the drainage pipes. Development of Initial Failure Appendix B summarizes a chronological progression of Root Causes analyses to the final genesis of the Initiating Blowout Failure, including the specific Root Causes ‘pre-failure conditions.’ A collection of critical evidential photographs, document clips, and images, from the combing through of thousands of pages of source information and a combined effort of thousands of hours of research and analyses, provides translation of the foregoing summaries to failure - into a ‘walk through’ of the cause and effect chronological progression ending in the final blowout of the spillway on February 7, 2017. The ‘walk through’ chronology also provides insight into the Human and Organizational Factors involved in how conditions continued to progress despite the many signs of distress in the spillway. By the time of the February 2017 spillway releases from the Oroville reservoir, the Gated Spillway had become heavily undermined and the foundation subgrade eroded by previous flood releases. The spillway releases completed the undermining of the spillway slabs, allowing water cavitation to further damage the slabs and open joints and cracks, and develop stagnation pressures and foundation subgrade seepage pressures to further erode the supporting soils and degraded rock and lift the ‘weak’ slabs (‘hydraulic jacking’) breaking them into pieces. After the almost catastrophic water release over the un-surfaced Emergency Spillway, the subsequent water releases down the gated spillway propagated the initial spillway breach until the spillway releases ceased. Organizational Root Causes Our investigations have concluded the Root Causes of the Gated Spillway failures are founded primarily in Organizational Malfunctions (see Appendix A and Appendix B) due to human and organizational decision making, task performance, knowledge development and utilization as developed and propagated by DWR and DSOD during the Gated Spillway Design, Construction, and Operations & Maintenance activities.6, 7 8 The report titled The “Watering Down” of the Division of Safety of Dams” concludes:cc “The most significant examples of organizational influence are the recently exposed existence of DSOD inspection reports dating back to 1989. For reasons yet to be fully determined, identified deficiencies were either ignored, treated as low priority, not acted upon or a combination thereof. However, complacency, lack of industry standard level maintenance, and possibly pressure from internal DWR management and external State Water Contractors’ representatives to hold down maintenance costs were key contributors. The lack of concern and focus in the timely addressing of the Dam Headworks concrete spalling and cracking, missing welds, gate trunion cable cracks, and dam abutment “wet spots”, all noted deficiencies listed in reports generated by DSOD, private engineering consultant(s), the Board of Consultants (which reports to the Director), US Army Corps of Engineers, and FRCIT, serve as prime examples of the DWR culture and failures.” In 2009, the American Society of Civil Engineers issued a report titled “Guiding Principles for the Nation’s Critical Infrastructure.” 11 This identified four guiding principles that form the foundation for Risk Management of the Nation’s Critical Infrastructure: 1. Quantify, communicate, and manage Risk, 2. Employ an integrated Systems approach, 3. Exercise sound Leadership, Management, and Stewardship in decision-making processes, and 4. Adapt critical infrastructure in response to dynamic conditions and practice. This report states: “these guiding principles are fully interrelated. No one principle is more important than the others and all are required to protect the public’s safety, health, and welfare.” A fundamental premise integrated into these four guiding principles is Risk Management. ASCE recommended four things needed to effectively integrate risk assessment, risk management, and risk communication strategies into our nation’s critical infrastructure programs: 1. Produce a best-practices guide and develop and publish codes, standards, and manuals for assessing and communicating risk. 2. Develop a public-policy framework that establishes tolerable risk guidelines and allocates costs for managing risks and consequences. 3. Provide professional education and training to members of the design and construction industries on identifying, analyzing, and mitigating risk. 4. Screen all existing critical infrastructure projects to determine if updated risk analyses are warranted. Require that Risk Analyses be performed for all proposed critical infrastructure projects. cc  The  “Watering  Down”  of  the  Department  of  Water  Resources  Division  of  Safety  of  Dams  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnUks4T3ljdjJLcWs 9 In 2016, the Federal Energy Regulatory Commission (FERC) issued Risk-Informed Decision Making (RDIM) Risk Guidelines for Dams. 16 These risk-based guidelines were issued 40 years after President Carter’s 1977 Memorandum on the Safety of Dams that explicitly addressed “risk based analysis,”dd and 7 years after the American Society of Civil Engineers issued the Guiding Principles for the Nation’s Critical Infrastructure that also explicitly addressed “manage risk.” There is no evidence that FERC or DWR - DOSD utilized this background during the Operations and Maintenance inspections of the Gated Spillway.1,5 The Orovile Dam Gated Spillway failure – self-destruction was preventable. Over decades, there were many opportunities for DWR, DSOD, and FERC to recognize and investigate serious issues that could have led to effective remedial measures. Evidenceee documented in this Root Causes Analysis Investigation (Appendix B) reveals the significant extent in decades of missed opportunities for DWR, DSOD, and FERC to detect and investigate severe anomalies.8 The lack of recognition of the significance of the severe issues revealed in Appendix B, from the beginning of the construction of the spillway to present, reveals the long-term systematic failures of DWR, DSOD, and FERC to identify and rectify critical components of the Oroville Dam Gated Spillway to the required level of the Operating Standard of Care: thus, “Negligent.”9 These egregious long-term repeated failures violated the First Principle of Civil Law: “imposing Risks on people if and only if it is reasonable to assume they have consented to accept those Risks.” Risk control is a central goal of Civil Law10 We have concluded DWR and DSOD should have taken the steps to update the design, construction, O&M standards and upgrade the Oroville Dam facilities so as to satisfy its documented Statutory, Regulatory, and Management responsibilities for the Safety and Risk Management of these facilities.r A superficial ‘Patch and Pray’ approach is not an acceptable Safety and Risk Management Process for important public infrastructure Systems. Previous experiences from formal Root Causes investigations of failures of both U.S. public and private industry infrastructure Systems (e.g. New Orleans hurricane flood protection system during Hurricanes Katrina and Ritaff , BP Deepwater Horizon Macondo well blowoutgg, and the PG&E San Bruno pipeline explosionhh) lead to the conclusion the wrong standards and dd  1977 Memorandum available at https://drive.google.com/open?id=0Bz1I1mIutSEnTGlSRzBMNTBsTDA   ee  A  summary  of  the  written  evidence  contained  in  DWR  –  DOSD  and  FERC  inspection  reports  is  provided  in  -­‐ https://drive.google.com/open?id=0Bz1I1mIutSEnNG1Vem9lYlFFcjA     ff  Katrina  Investigation  -­‐  https://drive.google.com/open?id=0Bz1I1mIutSEnSlBkVWktZi1uX28   https://drive.google.com/open?id=0Bz1I1mIutSEnNnEwbGRSV3ZxRHM     gg  BP  Deepwater  Horizon  Investigation  -­‐   https://drive.google.com/open?id=0Bz1I1mIutSEnVVdwbnF6czJGTmM   https://drive.google.com/open?id=0Bz1I1mIutSEnM2NrcnpPOEhzY00   https://drive.google.com/open?id=0Bz1I1mIutSEnRjFsUms2TVJRalk   https://drive.google.com/open?id=0Bz1I1mIutSEnbGRRdjlMc3FsSTg     hh  PG&E  San  Bruno  Investigation  -­‐  https://drive.google.com/open?id=0B0_jjqbhy5meWGV5aEtVeFE5OUU   https://drive.google.com/open?id=0Bz1I1mIutSEnTTEwcEpLRjFPWHM   10 guidelines were being used (applied) to re-qualify these other critical infrastructure systems for continued service. Like the Oroville Dam Gated Spillway, these critical infrastructure systems had embedded defects and flaws introduced during Design, Construction, and Operating & Maintenance that were combined with Aging, Technological Obsolescence, and increased Risk effects. Similarly, these infrastructure systems purportedly were designed, constructed, operated, and maintained according to the “Standards and Guidelines of the time.” In all cases, the evidence indicates there were multiple intentional deviations from these Standards and Guidelines during their entire life-cycles. All of these infrastructure Systems were regulated by Local, State, and Federal agencies. These major failures also represented ‘Regulated Failures.’ Further, our previous experiences from formal Root Causes investigations indicate the majority of Standards and Guidelines currently being used were originally intended for design, not requalification or re-assessment of existing aged infrastructure Systems that have experienced Aging, Technological Obsolescence, and increased Risk effects. Our reviews indicate in many cases ‘inappropriate’ standards and guidelines were being used to re-qualify these infrastructure systems for continued service. The currently available information indicates this continued long-term use of ‘out-of-date’ and ‘inappropriate’ii Standards, Guidelines, processes and procedures is one of the primary Root Causes of the failures of the Orville Dam Gated Spillway. Other Developments Gated Spillway Headworks We have reviewed documentation and written testimony that provides plentiful evidence (e.g., DWR – DOSD - FERC annual inspection reports 2008-16) there are important existing defects and damage in critically important parts of this Gated Spillway subsystem. The reported defects and damage include failed (2) and cracked (28) spillway gate anchor tendons (Figure 1), cracked reinforced concrete gate supporting structures (Figure 2), and severe gate binding. We have not found evidence these important Gated Spillway subsystem components have been included in the current or future DWR – DOSD – FERC Gated Spillway repair and rehabilitation planning. If the structural support and anchorages are inadequate to support the gate loadings, catastrophic failure of the gates could occur with catastrophic effects. Given the extreme importance of the Spillway Headworks, DWR – DOSD and FERC should be required to take effective actions to properly remediate these important structural components. Advanced Quality Assurance and Quality Control (QA/QC) equipment and methods should be used to assure that the desired initial and long-term Safety and Reliability characteristics of this important structure are achieved and maintained. ii  ‘Inappropriate’  -­‐  intentional  deviations  from  mandated  ‘acceptable  practice’  standards  and  guidelines.   11 Figure 1: Broken (2) and cracked (28) spillway gate control anchor tendons. Figure 2: Gate Headworks cracked reinforced concrete pier support structure. 12 Three reports written by the second author of this report review and analyze the available documentation on these concerns. These reports are summarized below and identified as Reports 6, 7, and 10:q Report 6: Large 14 Foot Crack in Headworks? Cracking Radial Gate Steel Tendons? Threat to Spillway yet no Repairs in 2017? A threatening 14 foot long crack growing in a massive 5 foot thick concrete pier at Radial Trunnion Gate 8 in Oroville's Spillway Headworks? DWR Board investigating how many of the internal cracking of the 50 year old aging "end of life" 384 steel anchor tendons may fail before they deem the Headworks operationally unsafe? Two steel tendons have already failed, test data reveals 28 more with crack indicators in the steel, some near the "critical failure size". Yet DWR doesn't know with certainty how many more are at risk of failure? Are there any plans to fix these major spillway Gate Headworks issues with emergency repairs for 2017? Why hasn't DWR revealed this information to the public? Report 7: Headworks Cracking Risking 3 Highest Level FERC Category 1 Probable Failure Modes? New Design Flaws Discovered? The Federal Energy Regulatory Commission (FERC) requires Potential Failure Mode (PFM) assessments at dams in a process to proactively identify modes of "potential" failure as a method to ensure appropriate safe operating performance margins. PFM's are an integral part of the FERC Dam Safety and Surveillance Monitoring Reporting process (DSSM's). High Reliability Systems, such as a dam and a spillway structure, require a constant assessment of conditions where FERC and the dam owners cooperate in this proactive DSSM's based exercise. Thus any findings requiring actions, whether further assessment or structural remedies, provide safeguarding the level of failure probabilities to "As Low As Reasonably Practicable" (ALARP). Civil law is based on this principle when entering into "controlling risk as effectively as possible" Report 10: Will Oroville Spillway Gates Fail in Heavy Flows? Design Flaws & Fixes Risk Gate Binding? In 2007, during an official Federal Energy Regulatory Commission (FERC) Inspection, Radial Gate 4 jammed after only lifting 6 feet of its 33 foot travel. From the perspective that all components of the Spillway Radial Gates are considered a High-Reliability System, what ensued in the subsequent Engineering Failure Analysis Report findings could only be read as an engineering nightmare. Quoting the Report: "During Federal Energy Regulatory Commission required operational testing Spillway Gate No. 4 would only open to approximately 7 feet at which time the motor would trip offline from overload." "Initial inspection found heavy galling marks on the right side wall plates as well as protruding bolts on the seal assembly directly adjacent to the wall plates. A bronze plate was also found between the wall and seal. This plate was later determined to be from a retrofit done in 1974." "The seal assemblies were removed and disassembled. A large amount of mud and debris was found behind the seal. The seal inflation piping was completely filled with mud and debris also. One bronze guide shoe was damaged beyond repair." "Two main items were attributed to the gate binding: 1. Lack of maintenance caused the system to degrade and become clogged with mud and debris. 2. Due to irregularities in the seal assemblies - it appears they were not properly 13 adjusted for the proper clearance over the entire length of the seal." Oroville Dam Persistent ‘Wet Spots’ We have reviewed DWR – DOSD – FERC Oroville Dam inspection reports covering the period 2008 – 2016. These reports contain a series of photographs that show the continued development of ‘Leaks’ and ‘Wet Spots near the dam abutments (Figures 3, 4, 5). DWR - DSOD, and FERC should be required to focus high quality field investigations and detailed analyses of the results from these investigations to determine and confirm if important seepage is taking place in and around the Oroville Dam. If such threats are confirmed, then proven effective remediation measures should be implemented and validated to assure that the dam is ‘Safe’ and ‘Reliable’ for current and future use. Figure 3: Does the water ‘seepage’ in the Oroville Dam endanger its Safety and Reliability? 14 Figure 4: 2015 image of vegetation following an upward elevation slope away from the left abutment. Erosion channels, greenage locations, non-greenage above and below and up the embankment, uphill water flow, contradicts against a left abutment spring. Image courtesy of Google Earth. Figure 5: Water does not flow uphill if the dam abutment ‘wet spot’ is a “natural spring.” 15 Four reports written by the second author of this report review and analyze the available documentation on these concerns. These reports are summarized below and identified as Reports 1, 2, 3, and 4: Report 1: Oroville Dam Leaking? 50yr Proof of "through the dam" leakage? Will the dam breach? Oroville Dam may be facing a breach danger from a serious and a dangerous form of a slow motion failure mode of the left abutment of the dam. Recently, authorities to the dam have responded to the public stating "its a natural spring", or "the green spot is from rain". Yet, outside of a public forum, DWR asked the Federal Energy Regulatory Commission (FERC) to move a test drill well near the leakage to try to get answers in 2016. If it's known to be a harmless "natural spring" or from "rain" why drill? Why hasn't DWR publicly announced that they have a "test well" near the leakage area, which they noted to FERC, quote "data collected may be beneficial in understanding seepage"? However, DWR's recent town hall meeting's answers, by DWR engineers and representatives, do not stand up to honest engineering scrutiny. The public deserves an honest technical risk assessment of this known dam failure mode threat. Report 2: Oroville Dam Breach? DWR Investigating Leaking - Hasn't Revealed This to the Public - Oroville Dam may be exhibiting a dangerous failure mode from an effect known as "Differential Settlement". This phenomenon occurs by sections of the dam "compacting" at a different rate. Thus, internal forces are applied to the center of the dam that has known to cause loss of the integrity of the core, cracking of the core, clogging of the internal drainage system, and longitudinal cracking along the interface between embankment zone fill materials. Historic failures of "Differential Settlement" at dams has found a critical component that risks the danger from the dam having an abutment with a "sharp abutment" slope change. A first sign of this alarming problem would be unexplained seepage, wet spots, or greening areas on the back side of the dam (to which Oroville Dam is exhibiting). Report 3: Oroville Dam History Images, Reveals Clues to Dam Leakage? What Should be Done? Mysteries to the clues of Oroville Dam's leakage revealed in historical dam images? Does DWR/DSOD already know that there is a leak through the dam from inspection reports, yet they are keeping this from the public? Why push the narrative of "rain falls...then grass grows" when the public should be made fully aware of a potentially serious precursory dam failure mode? What should be done to guarantee that this leak is not at an accelerated threshold risk threat if there is greater "unseen" leakage? Report 4: Oroville Dam Leak? With All Internal Dam Water Sensors Broken? No Breach Warning? An earthquake induced leak or if an internal erosion defect develops, deep within the earthen fill zones at Oroville dam, DWR would have no warning, nor the ability to do an immediate slope stability assessment, as the numerous dam's internal Piezometers are non-functional or dead. FERC has been asking DWR to fix this issue for years, as it's a major Dam Safety Issue. Why hasn't DWR responded? Why does the tallest earthen dam in the U.S.A. have zero working Piezometers to detect any threat to a potential internal instability to warn citizens of a pending breach? 16 Remediation of Organizational Root Causes Recommendation #1 DWR – DOSD have demonstrated important needs for significant additional resources – primarily human and organizational resources – to help them get the proposed spillway repairs and rehabilitation efforts completed so those parts of the Oroville Dam system can meet current applicable System Risk Assessment and Management based standards and guidelines for development of High-Reliability Organizationsjj having High-Reliability Management able to deliver High-Reliability Systems with As Low As Reasonably Practicable Risks.11 This development would go above and beyond the current standards and guidelines currently cited by DWR, DSOD, and the DWR Board of Consultants. The Oroville Dam is an extremely important part of the State Water Project and of California’s public infrastructure systems. Going forward, the Best Available and Safest Technology (BAST) should be required and properly used.12 In addition to the results from this Root Causes Investigation, this recommendation is based on experiences and results from a six-year duration research and development project sponsored by the NSF and conducted by the Center for Catastrophic Risk Management (CCRM) at the University of California Berkeley. This project was identified by NSF as the RESIN systems project.kk This project had two fundamental goals: 1) further develop and validate advanced analytical processes and procedures that could provide realistic quantitative evaluations of Risks associated with operations of complex engineered infrastructure systems—SRAM processes, and 2) apply these advanced validated SRAM analytical processes and procedures to the infrastructure systems in the California Sacramento – San Joaquin Delta.9 The advanced SRAM analytical procedures and processes were developed and validated with applications to past infrastructure failures.9 Then, these validated SRAM analytical procedures and processes were applied to several specific infrastructure systems that had particular importance to continued operations in the California Delta.9 These specific structure locations were identified with a Geographic Infrastructure System (GIS) developed specifically for the RESIN project in accordance with the guidelines provided by the Department of Homeland Security and the Federal Emergency Management Agency (FEMA). The locations were identified as choke points – locations where failures would trigger failures of the other infrastructure systems that were in the same locations; these multiple infrastructure systems were interconnected, interdependent, and highly interactive. Two environmental conditions were specified: 1) potential flooding events during 2010, and 2) potential flooding events during 2100 (including potential effects from global climate changes, and continued use jj  See  Appendix  A  pages  13  –  17  for  background  on  characteristics  High  Reliability  Organizations.   kk   University of California CCRM NSF RESIN research and development project - http://ccrm.berkeley.edu/resin/ 17 of the 2100 inspection, maintenance, and repair Operations and Maintenance processes and procedures). The two locations chosen for the application of the advanced analytical formulations and processes were: 1) Sherman Island and 2) Natomis Basin. Representatives from local, state, and federal government agencies that had responsibilities for the infrastructure systems were involved in these developments (e.g., DWR, California Emergency Management Agency, U.S. Army Corps of Engineers, Sherman Island Reclamation Board, U.S. Coast Guard, University of California Davis, University of Colorado, Mills College). During this project, the RESIN research project team involved 35 faculty members, 73 undergraduate and graduate students in courses and research projects developed for this project, six post-doctoral researchers, and many other vital support personnel. Results from the applications were documented extensively in public reports and reports to NSF, and published in reports, presentations, graduate and undergraduate courses, and refereed conference and journal publications. During 2009 – 2010, results from these applications were presented to public and government representatives concerned with the infrastructure systems located at Sherman Island and the Natomis Basin. These applications of the advanced SRAM processes and procedures to the infrastructure systems at the two locations had one consistent result:13 The risk of major infrastructure systems failures were not “tolerable” or “As Low As Reasonably Practicable” (ALARP) based on U.S. and international Risk Tolerability guidelines. The recent experiences with other U.S. infrastructure systems have served to corroborate results from these NSF RESIN Infrastructure SRAM studies (New Orleans hurricane flood protection system during Hurricanes Katrina and Rita, BP Deepwater Horizon Macondo well blowout, and the PG&E San Bruno pipeline explosion). The infrastructure System Risk Assessment and Management challenges at the Oroville dam involve much more than the Oroville Dam infrastructure system challenge. These infrastructure SRAM challenges also are State14 and U.S. National challenges.11,15 Recommendation #2 DWR’s Management, Division of Engineering, and Division of Operations and Maintenance (O&M) standards, guidelines, procedures, and processes should be founded on the proven best available SRAM technology. This technology includes, but “goes beyond”, that currently documented in the U.S. Army Corps of Engineer’s Dam Safety guidelines,16, llin the Federal Energy Regulatory Commission (FERC) Risk Guidelines for Dam Safety,17 in the Federal ll  More  background  provided  at  http://www.iwr.usace.army.mil/Missions/Flood-­‐Risk-­‐Management/Flood-­‐ Risk-­‐Management-­‐Program/About-­‐the-­‐Program/Policy-­‐and-­‐Guidance/      and  http://www.iwr.usace.army.mil/Missions/Flood-­‐Risk-­‐Management/Flood-­‐Risk-­‐Management-­‐ Program/About-­‐the-­‐Program/Policy-­‐and-­‐Guidance/Federal-­‐Flood-­‐Risk-­‐Management-­‐Standard/     18 Emergency Management Agency (FEMA) Federal Guidelines for Dam Safety,18 and in the Bureau of Land Management (BLM) Dam Safety Public Protection Guidelines.19,mm The most important “goes beyond” elements concern those associated with Human and Organizational Factor Uncertainties (Appendix A).2, 6, 10 Multi-decade International use of System Risk Assessment and Management processes has clearly shown these elements must be included in valid and validated procedures and processes required to develop “realistic” assessments of the likelihoods and consequences (Risks) of major failures and for development and implementation of effective risk management barriers – standards, guidelines, procedures, and processes – used during the life-cycle of important public and private infrastructure systems. Analyses of these “Human and Organizational Factor” Uncertainties (Extrinsic, Types 3 and 4 Uncertainties) are combined with those included in many traditional engineering analyses: natural (Aleatory) variability and analytical model (Epistemic) uncertainties (Intrinsic, Types 1 and 2 Uncertainties). Detailed investigation of a wide variety of failures associated with engineered infrastructure Systems has demonstrated that the majority of the Root Causes of these failures are associated with Human and Organizational Factors – Extrinsic Uncertainties. All four categories of Uncertainties must be included to develop realistic full-scope Risk Analyses, thus avoiding the “E3” error of “working the wrong problems precisely.”2, 13 Other countries have continued, and are continuing, to implement advanced System Risk Assessment and Management standards and guidelines to help manage, engineer, construct, operate and maintain their important infrastructure systems. Examples include those developed and implemented by the U.K. Health and Safety Executive in their Safety Case Regime developments, and by the governments of Australia and New Zealand in their Risk Management Guidelines.20,21 The International Standards Organization (ISO) have developed and published a large number of very useful standards based on System Risk Assessment and Management that have been incorporated into those of the U.K. Health and Safety Executive, and those of Australia and New Zealand.22 In addition, similar standards and guidelines have been developed and implemented in Norway and the Netherlands.23 These Standards and Guidelines – ‘Safety Case Regimes’ – address both Intrinsic (Types 1 and 2) and Extrinsic (Types 3 and 4) Uncertainties. In the U.S., the commercial Nuclear Power Generation and Transmission organizations and owner-operators (e.g., the PG&E Diablo Canyon nuclear power plant) and the U.S. Nuclear Regulatory Commission (NRC) for many years have applied this proven advanced technology.nn Similarly, the commercial public air transportation organizations (e.g. United Airlines, Boeing Aircraft Company) and the U.S. Federal Aviation Administration (FAA) have applied this technology in development of their standards, guidelines, procedures and processes. These organizations have developed an admirable record for safety and reliability. The U.S. Chemical mm  For  additional  references  consult  National  Dam  Safety  Program  at   http://damsafety.org/resourcecenter/national-­‐dam-­‐safety-­‐program-­‐guidelines-­‐flyers-­‐and-­‐other-­‐tools     nn Nuclear Regulatory Commission SRAM Probabilistic Risk Analyses (PRAs) – http://www.nrc.gov/about-nrc/regulatory/risk-informed/pra.html     19 Safety Board (CSB) and Center for Chemical Process Safety have advanced a similar set of standards and guidelines for implementation of safety case regimes for high hazard chemical processing facilities.oo Experience during the past several decades has shown that System Risk Assessment and Management technology, if properly implemented, can be very useful to help develop and maintain Safe (risks are ALARP) and Reliable (high likelihoods of delivering acceptable performance) systems. This experience has also shown that if not properly implemented, System Risk Assessment and Management technology can be very counterproductive. Some of this experience has shown that improper implementation can help cause major infrastructure system failures.2, 8 The single most important resource required for proper implementation are people who have formal training and experience in Risk Management – System Risk Assessment and Management processes and procedures. Experience and results from analyses of 10-year duration formal efforts by seven organizations to effectively apply SRAM technology has shown that “Five Cs” are required to be able to develop and maintain safe and reliable systems.24 All Five Cs are required all of the time to be able to realize success with implementation of this technology. The Five Cs are: 1) Cognizance – the involved organizations must develop an acute awareness of the hazards and threats that confront their systems. Worry and concern is constant. Awareness is crucial. Diligence to maintain systems with ALARP Risks that are ‘Safe’ is even more critical. 2) Commitment – the management and operating personnel must develop a sustained ‘top down and bottom up’ commitment from those involved that the necessary resources (human, organizational, monetary, knowledge, experience, physical, environmental) will be provided to enable effective application of ALARP risk management ‘barriers’ (integrated proactive, reactive, and interactive processes) to enable development and maintenance of systems that have ALARP risks. The commitment must be to develop high reliability organizations with high reliability management that will consistently deliver systems having ALARP risks. 3) Culture – The beliefs, values, feelings, and resource allocation and utilization processes of the organization must be one devoted to “Getting it right, doing it right and knowing what is right,” consistently delivering Systems that have ALARP risks, and understanding that these efforts require constant vigilance, diligence and continuous improvements. 4) Capabilities – The human, organizational, and other parts of the systems (combinations of human operators, responsible organizations, hardware, structures, environments, standards and guidelines, and the interfaces between these interconnected, interactive, interdependent components) must be highly developed and “excellent” so the proven oo  https://www.aiche.org/ccps/topics/elements-­‐process-­‐safety/commitment-­‐process-­‐safety/process-­‐safety-­‐ culture     20 principles of SRAM technology can be properly and effectively developed and implemented. These efforts are focused on continuous improvements to enable realization of the different kinds of benefits from application of SRAM technology. 5) Counting – This is a very important ‘C.’ Counting means development of valid and validated quantified metrics (with numbers) that can be used by managers, engineers, and operations and maintenance personnel to help them determine system risks (likelihoods and consequences) throughout the life-cycle of a system. These valid and validated metrics serve the same purposes as an automobile speedometer; to give the diver/s dependable ways to determine the safe speed, given the road, traffic, weather, and surrounding community conditions; the safe speed (ALARP risk) depends on the local conditions. Risks that are ALARP are based on quantitative monetary cost-benefit evaluations that include proper recognition of both short-term and long-term monetary costs (direct, indirect, onsite, offsite, property, productivity, quality of human life, and environmental impacts), standards-of-practice evaluations, historic precedents, and national and international standards and guidelines for determination of ALARP risks.25 What is effectively measured can be more effectively managed. Summary Results from this investigation of the Root Causes of the failures of the Gated Spillway, Emergency Spillway, and Other Developments (Spillway Headworks, Dam Abutments ‘Wet Spots’) have been consistent with those from a large number of previous forensic investigations of failures and disasters associated with engineered infrastructure systems: it is the Human and Organizational Factors that are the primary challenge to being able to develop Safe and Reliable engineered infrastructure systems.26 This is the reason for emphasizing in this report the need to develop high-reliability organizations with high-reliability management that can and will deliver High Reliability Systems that have As Low As Reasonably Practicable Risks and are Safe, Durable, Serviceable, and Compatible (Appendix A). http://damfailures.org/ 21 References 1 Bea, R. G. (2017a): Preliminary Root Causes Analysis of the Failures of the Oroville Dam Bea, R.G. (2017b): Legislative Oversight Testimony Report, Center for Catastrophic Risk Management, University of California Berkeley, April 17, available at https://drive.google.com/open?id=0Bz1I1mIutSEnWHozRUsyNFl1Y2c 2 Bea, R.G. ( 2016): “What Is Safe?,” MedCrave, MOJ Civil Engineering, Vol. 1, No. 1, https://drive.google.com/open?id=0Bz1I1mIutSEnbUgwUXZ6WXlYMmc 3 Design documents Department of Water Resources (1967): Design Engineer’s Criteria for Operation and Maintenance, State Water Facilities, Oroville Division, Oroville Dam and Reservoir, Oroville, California. California State Water Project (19740: Volume III, Storage Facilities, Bulletin Number 200, November, https://drive.google.com/open?id=0Bz1I1mIutSEnR1VIcHp2amZjbU0 California Department of Water Resources (1965): Oroville Dam Spillway Chute Plan, Profile and Typical Sections, February. California Department of Water Resources (1965): Oroville Dam Spillway Terminal Structure, Concrete and Details, February. U.S. Dept. of the Interior Bureau of Reclamation (1965): Hydraulic Model Studies of the Flood Control Outlet and Spillway for Oroville Dam, California Department of Water Resources, State of California, Report No. Hyd-510, September https://drive.google.com/open?id=0Bz1I1mIutSEnQXFWRmxnc0dYOXM 4 Construction documents Department of Water Resources (1968): Final Construction Report on Oroville Dam Spillway, State of California, The Resources Agency, Department of Water Resources, Division of Design and Construction, Oroville, California. Department of Water Resources (1970): Final Geologic Report, Oroville Dam Spillway, Project Geology Report C-38, State of California, The Resources Agency, Department of Water Resources, Division of Design and Construction, State Water Facilities, Oroville Division, Butte County, California. 5 Operations and Maintenance documents Cited inspection reports originally available at: https://d3.water.ca.gov/owncloud/index.php/s/zSySIi4jky0G6es California Department of Water Resources, Division of Safety of Dams (1998): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (1999): Inspection of Dam and Reservoir in Certified Status, June. 22 California Department of Water Resources, Division of Safety of Dams (2000): Inspection of Dam and Reservoir in Certified Status, January. California Department of Water Resources, Division of Safety of Dams (2000): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2001): Inspection of Dam and Reservoir in Certified Status, January. California Department of Water Resources, Division of Safety of Dams (2001): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2002): Inspection of Dam and Reservoir in Certified Status, January. California Department of Water Resources, Division of Safety of Dams (2002): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2002): Inspection of Dam and Reservoir in Certified Status, November. California Department of Water Resources, Division of Safety of Dams (2003): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2004): Inspection of Dam and Reservoir in Certified Status, January. California Department of Water Resources, Division of Safety of Dams (2005): Inspection of Dam and Reservoir in Certified Status, February. California Department of Water Resources, Division of Safety of Dams (2006): Inspection of Dam and Reservoir in Certified Status, April. California Department of Water Resources, Division of Safety of Dams (2008): Inspection of Dam and Reservoir in Certified Status, May. California Department of Water Resources, Division of Safety of Dams (2009): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2009): Inspection of Dam and Reservoir in Certified Status, August. California Department of Water Resources, Division of Safety of Dams (2010): Inspection of Dam and Reservoir in Certified Status, June. California Department of Water Resources, Division of Safety of Dams (2011): Inspection of Dam and Reservoir in Certified Status, February. California Department of Water Resources, Division of Safety of Dams (2011): Inspection of Dam and Reservoir in Certified Status, October. California Department of Water Resources, Division of Safety of Dams (2013): Inspection of Dam and Reservoir in Certified Status, February. 23 California Department of Water Resources, Division of Safety of Dams (2013): Inspection of Dam and Reservoir in Certified Status, September. California Department of Water Resources, Division of Safety of Dams (2014): Inspection of Dam and Reservoir in Certified Status, April. California Department of Water Resources, Division of Safety of Dams (2014): Inspection of Dam and Reservoir in Certified Status, September. California Department of Water Resources, Division of Safety of Dams (2015): Inspection of Dam and Reservoir in Certified Status, March. California Department of Water Resources, Division of Safety of Dams (2015): Inspection of Dam and Reservoir in Certified Status, August. California Department of Water Resources, Division of Safety of Dams (2016): Inspection of Dam and Reservoir in Certified Status, September. 6 Bea, R.G. (2005): “System Risk Assessment and Management,” Center for Catastrophic Risk Management, Univ. of California Berkeley, https://drive.google.com/open?id=0Bz1I1mIutSEnTFVkaDUxLTNYZ2M Bea, R.G. (1999): “Human and Organizational Factors in the Quality and Reliability of Engineered Systems,” Proceedings of Seminar on Managing Safety in Hazardous Processes, SHE Pacific Pty. Ltd., Melbourne, Australia, Nov. 26, 1999, https://drive.google.com/open?id=0Bz1I1mIutSEnd21SSVFUVk5veVU Bea, R.G. (2005): “Reliability and Human Factors in Geotechnical Engineering,” Journal of Geotechnical and Geoenvironmental Engineering, American Society of Civil Engineers, New York, NY, November, https://drive.google.com/open?id=0Bz1I1mIutSEnNkhFOUFKa05nbmM 7 Bea, R.G. (2006): “Learning from Failures: Lessons from the Recent History of Failures of Engineered Systems,” Center for Catastrophic Risk Management, Univ. of California Berkeley, https://drive.google.com/open?id=0Bz1I1mIutSEnalNWWmpGMm9jajQ 8 Stork, R. (2017): “The Delicate Question of Geology and Institutions,” Friends of the River, Center for Catastrophic Risk Management Oroville Dam Advisory Group, Univ. of California Berkeley, https://drive.google.com/open?id=0Bz1I1mIutSEnRHRKUFIzVHBsUVE 9 Kardon, J.B. (2009): “Testifying Regarding The Standard of Care,” Proceedings 5th Forensic Engineering Conference, American Society of Civil Engineers, New York, NY. https://drive.google.com/open?id=0B0_jjqbhy5meR0xkM3ZYY29zREE 10 Bea, R.G. (200): “An Instrument of Risk Management: The Law,” Center for Catastrophic Risk Management, University of California Berkeley, https://drive.google.com/open?id=0Bz1I1mIutSEnYjFfTGpXeTZXQmc 11 Roe, E., and Bea, R. (2016): “Risk Assessment and Management for Interconnected Critical Infrastructure Systems at the Site and Regional Levels in California’s Sacramento-San Joaquin 24 Delta,” Journal of Critical Infrastructures, Vol. 12, Nos. 1/2, https://drive.google.com/open?id=0Bz1I1mIutSEnby1kQ04xQ0tpdHM Bea, R.G., Mitroff, I., Farber, D., Foster, H. and Roberts, K.H.: (2009): “A New Approach to Risk: The Implications of E3,” Risk Management, Vol. 11, 1, 30–43, Palgrave Macmillian Publishers, https://drive.google.com/open?id=0Bz1I1mIutSEnUEJtbmluSVVCa0U 12 American Society of Civil Engineers (2009). “Guiding Principles for the Nation’s Critical Infrastructure,” ASCE Critical Infrastructure Guidance Task Committee, New York, NY, https://drive.google.com/open?id=0Bz1I1mIutSEnVk91ZE9GM3UzSnM McCann, M.W. (2017): “The Oroville Incident – An Opportunity for Dam Safety,” Water Power and Dam Construction Magazine, July 13, https://drive.google.com/open?id=0Bz1I1mIutSEncWVqMkZsV1RlNTQ http://www.waterpowermagazine.com/features/featurethe-oroville-incident-an-opportunity-fordam-safety-5868893/ Jonkman, S., et al (2014): “Integrated  Risk  Assessment  for  the  Natomas  Basin,  California:   Analysis  of  Loss  of  Life  and  Emergency  Management  for  Floods,”  Center  for  Catastrophic   Risk  Management,  University  of  California  Berkeley,   https://drive.google.com/open?id=0Bz1I1mIutSEnekIySnZnOHJkWWM     Hamedifar, H., Bea, R.G., Pestana-Nascimento, J.M., and Roe, E.M. (2014): “Role of Probabilistic Methods in Sustainable Geotechnical Earthen Embankment Overtopping Analysis,” XV Danube - European Conference on Geotechnical Engineering (DECGE 2014), Paper No. 29, Vienna, Austria, https://drive.google.com/open?id=0Bz1I1mIutSEnNjRwTGwxYXg4aGc 13 Bea, R.G., Roe, E, and Hamedifar, H. (2013): “Preliminary Results of RESIN Initiative: Sherman Island Flood Defense System,” Sherman Island Reclamation District 341, March 12th 2013, https://drive.google.com/open?id=0Bz1I1mIutSEnclRwVGNHanVfb1U 14 American Society of Civil Engineers (2017a): “Key Facts About California’s Infrastructure,” New York, NY, https://drive.google.com/open?id=0Bz1I1mIutSEnUGNRTVBhNnZsTlE American Society of Civil Engineers (2017b): “2017 Infrastructure Report – Dams,” New York, NY, https://drive.google.com/open?id=0Bz1I1mIutSEnYm40OGU0TmdUMFE American Society of Civil Engineers (2017c): “2017 Infrastructure Report – Energy,” New York, NY, https://drive.google.com/drive/u/1/folders/0B7s3aAUMwV12eTF3Qk1CLW5VV3c American Society of Civil Engineers (2017d): “2017 Infrastructure Report - Levees,” New York, NY, https://drive.google.com/drive/u/1/folders/0B7s3aAUMwV12eTF3Qk1CLW5VV3c 25 15 American Society of Civil Engineers (2017e): “2017 Infrastructure Report Card: A Comprehensive Assessment of America’s Infrastructure,” New York, NY, https://drive.google.com/open?id=0Bz1I1mIutSEnYm40OGU0TmdUMFE American Society of Civil Engineers (2017f): “FAILURE TO ACT – Closing the Infrastructure Investment Gap for America’s Economic Future,” New York, NY, https://drive.google.com/open?id=0Bz1I1mIutSEnSzdoR1JYaUtYZ3c 16 U.S. Army Corps of Engineers (2014): Engineering and Design: SAFETY OF DAMS – POLICY AND PROCEDURES, Regulation No. 1110- 2-1156, Washington, DC, https://drive.google.com/open?id=0Bz1I1mIutSEnZHdCak5xdnE4S1U 17 Federal Energy Regulatory Commission ( 2016): Risk Informed Decision Making (RIDM) Risk Guidelines for Dam Safety, Washington DC, https://drive.google.com/open?id=0Bz1I1mIutSEnUWw5RGdKMVNsaGc 18 Federal Emergency Management Agency (2004): Federal Guidelines for Dam Safety, Washington, DC, https://drive.google.com/open?id=0Bz1I1mIutSEnTVVQam9QSXY5NXM https://drive.google.com/open?id=0Bz1I1mIutSEndEVXSGltZmNBTGc 19 U.S. Department of the Interior Bureau of Land Management (2011): Dam Safety Public Protection Guidelines, Washington, DC https://drive.google.com/open?id=0Bz1I1mIutSEnei1pNVpibUI5MFk 20 HSE - Heath and Safety Executive (2015), Assessment Principles for Offshore Safety Cases (APOSC), London, England, http://www.hse.gov.uk/risk/theory/alarp2.htm, https://drive.google.com/open?id=0Bz1I1mIutSEnUXRpTG1WS214OWs 21 Australian Standard (1999), RISK MANAGEMENT, Australia – New Zealand Standard 4360:1999, Standards Australia, Strathfield, New South Wales, https://drive.google.com/open?id=0Bz1I1mIutSEncHVEbDdyYXNXQ00 22 International Standard – ISO 31000 (2009): Risk management guidelines, Reference number ISO 31000:2009(E), Switzerland, https://drive.google.com/open?id=0Bz1I1mIutSEnT3ROX2NzS3RWRDQ 23 NORSOK STANDARD Z-103, Federation of Norwegian Industry, et al (2010): Risk and emergency preparedness assessment https://drive.google.com/open?id=0Bz1I1mIutSEnVkZpbEYwWXdUa1U 24 Bea, R.G. (1999): “The Next Steps: Advancing the Causes of Quality, Reliability and Safety,” Proceedings of the Workshop on Behavioral Change and Safety, Woodside Offshore Petroleum Pty, Ltd, Perth, Western Australia, Nov. 24, https://drive.google.com/open?id=0Bz1I1mIutSEnbk9fZG5EOGlKR0U 26 25 Bea, R.G. (2000): “Target Reliabilities for Engineered Systems,” Center for Catastrophic Risk Management, University of California Berkeley, https://drive.google.com/open?id=0Bz1I1mIutSEnLUVMTnBIOW1fTEE 26 Alvi, I.A. (2017): “Human Factors in Dam Failures,” https://drive.google.com/open?id=0Bz1I1mIutSEnOTNiSUtoNTFqdFk http://alviassociates.com/yahoo_site_admin/assets/docs/Human_Factors_in_Dam_Failures__Alvi_2013.176153049.pdf 27 APPENDIX A Background Summary: Root Causes Analyses, Engineered Systems, Human & Organizational Factors, and Taxonomies for Root Causes Analyses1 Root Causes Analyses The Center for Chemical Process Safety (CCPS) has developed guidelines for investigating incidents and performing safety audits associated with near-misses and failures of engineered systems (1992, 1993, 1994)2. These guidelines indicate that the attitudes and beliefs of the involved organizations are critical in developing successful systems, particularly doing away with ‘blame and shame’ cultures and practices (Turner, 1991; Rasmussen, 1980). It is further observed that many if not most accident and failure investigation systems focus on ‘technical causes’ including equipment and hardware. Human – system failures are treated in a cursory manner and often from a safety engineering perspective that has a focus on outcomes of errors (e.g. inattention, lack of motivation) and statistical data (e.g. lost-time accidents). Guidelines have been developed for incident reporting systems, near-miss reporting systems, and Root Cause Analysis investigation, assessment, and documentation processes for failures of engineered systems (Center for Chemical Process Safety, 1992, 1993, 1994; Bea, 2009). The primary objective of incident reporting systems is to identify recurring trends from the large numbers of incidents with relatively minor outcomes. The primary objective of near-miss systems is to learn lessons (good and bad) from operational experiences. Near-misses have the potential for providing more information about the causes of serious accidents than accident information systems. Near-misses potentially include information on how the human operators have successfully returned their systems to safe-states. These lessons and insights should be reinforced to better equip operators to maintain the quality of their systems in the face of unpredictable and unimaginable unraveling of their systems. Root Cause Analysis is generally interpreted to apply to systems that are concerned with detailed investigations of failures of engineered systems with major consequences (Figs. A.1–2). The authors have a fundamental objection to the term ‘Root Cause’ Analysis because of the implication there is a single cause at the root of the accident. This is rarely the case. Identification of a single Root Cause is an attempt to simplify what is generally a very complex set of interactions and factors, and in this attempt, the lessons that could be learned from the accident are lost. 1  Human  and  Organizational  Factors:  Risk  Assessment  and  Management  of  Engineered  Systems  (2010),  by  R.  G.   Bea,  Vick  Copy  Publishers,  Berkeley,  CA,  94720.   2  References  provided  in  last  Section  of  Appendix  A.   1 Root Cause Analysis 0 Mmm??sh?smmw 0 Mwm?dhaumbly adallowfumdm?m ?Massimiliano.- Fig.A.1 Physical Cause 1 Human Cause Incorrect decusuon Improper actlon or lack of action \Nhat In?uenced tms?) Were there personal reasors vvnat Old support or that In?uenced prevent the human action? What were they?7 System Cause Human Cause Processes failed to support desrrable human actlon Performer - . Yul de? at 3'1 - h'eMa SID - merta (very-ad . 7 Root Cause(s) 7 Fig?A'2 Lowest level otcause(s)tnat can reasonably be which. It corrected. would prevent the incldentfrom recurn'ng/ Important elements in a Root Cause analysis includes an investigation procedure based on a model of accident causation. A systematic framework is needed so that the right issues are addressed during the investigation. There are high priority requirements for comprehensiveness and consistency. The comprehensiveness needs to be based on a systems approach that includes error tendencies, error inducing environments, multiple causations, latent factors and causes, and organizational influences. The focus should be on a model of the system factors so that error reduction measures and strategies can be identified. The requirement for consistency is particularly important if the results from multiple accident analyses are to be useful for evaluating trends in underlying causes over time. Systems that have been used extensively in development of Root Cause analysis systems include the Tree of Causes (Leplat, 1982), MORT (Management Oversight & Risk Tree) (Johnson, 1980), STEP (Sequentially Timed Events Plotting) (Hendrick and Benner, 1987), and the HPIP Human Performance Investigation Process (Paradies, et al, 1992). The principle of the Tree of Causes method is that an accident results from changes or variations in normal processes. These variations must be identified, listed, and organized into a inductive analysis diagram (starting with the accident and working backward to define the causes and interactions) to define their interrelationships. This method was further developed by Leplat and Rasmussen (1984) in a Variation Diagram approach. This development was based on application of the Rasmussen ‘stepladder’ model of human error at each branch of the inductive analysis diagram. This stepladder model involved an alert on the part of a system operator, observation of what might be abnormal, identification of the state, evaluation of the implications, definition of goals for returning the system to a safe state planning how to accomplish the plan, formulating and executing the actions, and then developing feedback on the effects of the action/s. This involved skill, rule, and knowledge based activities, shortcuts, and information feedback loops (Rasmussen, 1986). MORT was developed to provide a disciplined method for defining and evaluating the causes and contributing factors of major accidents in nuclear power plants. The approach utilizes a logic diagram which represents an idealized safety system based on a fault tree method. The diagram defines specific control factors and general management factors. MORT does not provide a process to guide the investigation or the representation of the accident sequence. The MORT process addresses oversights and omissions, assumed risks, control factors, and management system factors. STEP is an investigation process that structures data collection, representation and analysis. Actors (individuals, equipment, etc. involved in the accident), actions, and events are identified and portrayed in an event sequence diagram. This diagram involves listing the agents down a vertical axis and establishing a time line on the horizontal axis showing how the agent’s actions interact to cause the accident. A necessary and sufficient test is applied to pairs of events and checks for completeness and sequencing are made. The analyst proceeds through the diagram to identify the sets of events that were critical in the accident sequence. These critical events are used to develop a causal analysis based on Root Cause Coding (Armstrong, 1989). The Root Cause Coding consists of six levels that address equipment failures, quality failures, management systems failure, and human error. The STEP decision tree identifies the critical 3 actions and events. Starting at the top level of the tree, the analyst has to determine whether the critical event involved equipment, operations, or technical difficulties. Based on the identification, the analyst identifies more specific issues relating to function, equipment, major root causes, near root causes, and finally root causes. HPIP combines many of the techniques described above. HPIP involves seven stages in the investigation of an accident (Paradies, et al, 1992): 1) failed System investigation, 2) event sequence development, 3) analysis of barriers and human performance difficulties, 4) analysis of root causes, 5) analysis of programmatic causes, 6) evaluation of corrective actions and identification of violations, and 7) development of a report. The plant investigation involves collecting physical and documentary evidence and interviewing key participants. The event sequence is developed in a manner similar to that described in the Tree of Causes and STEP. A task analysis method is used to identify the critical actions necessary for the performance of a task and a Change Analysis is performed to define the roles of changes in the accident causation. The Change Analysis (Ferry, 1988) considers planned versus unplanned changes, actual versus potential changes, time changes, technological changes, personnel changes, sociological changes, organizational changes, and operational changes. It is not often that one can truly understand the Root Causes of accidents (Center for Chemical Process Safety, 1992). If one does not understand the true Root Causes, how can one expect to put the right measures in place to prevent future accidents? Further, if the causes of accidents represent an almost never to be repeated collusion of complex actions and events, then how can one expect to use this approach to prevent future accidents? Further, the usual reaction to accidents has been to attempt to put in place hardware and equipment that will prevent the next accident. Attempts to use equipment and hardware to fix what are basic Human and Organizational Factor related problems generally have not proven to be effective (Center for Chemical Process Safety, 1994). Engineered Systems Any activity that involves people is subject to flaws and defects (Reason, 1990)3. These flaws and defects (malfunctions) are generally identified as errors. Human and Organizational Errors (malfunctions) represent the hazards (threats to Quality of Systems) associated with Human and Organizational Factors. Human and Organizational Errors are ‘results, not causes’ (Woods, 1990, 1994). Human and Organizational Factors that occur during the life-cycle of an Engineered System can be related first to the individuals who design, construct, operate, maintain, and decommission the system. These are the ‘front-line’ System Operators – Operating Teams. The actions and inactions of these operators are influenced to a very significant degree by five other components that comprise Engineered Systems (Fig. A.3): 3  References  listed  at  the  end  of  Appendix  A.   4 • • • • • The   Organizations   they   work   for   and  with,     The   Procedures   (formal,   informal,   software)   they   use   to   perform   their   activities,     The   Structures   and   Hardware   (equipment)   involved   in   these   activities,     The   Environments   (external,   internal,   social)   in   which   the   Operator   activities   are   performed,   and   The   Interfaces   between   the   foregoing  components.   These components are highly interrelated, interactive, and interdependent. Operating Teams Factors Structural Factors Organizational Factors Interfaces Factors Environmental Factors Hardware Factors Procedural Factors Fig A.3: Influences on the Quality, Safety, Reliability and Risks associated with engineered Systems A System is a set of two or more elements (components) whose behavior has an important effect on the behavior of the system, and are interdependent, inter-related and interactive. In this report, the term 'Engineered System' is used: a system is a collection of elements (components) which interact with each other to function as a whole. These assemblies are brought into being through the processes that include concept development, design, construction / manufacturing, operations, maintenance, and decommissioning. Management of the engineering processes is also included. Synthesis is the key to understanding engineered systems and includes identifying and describing a system of which the elements to be understood are a part, explaining and understanding the properties and functioning of the system and explaining and understanding the behaviors of the elements in terms of their roles in the functioning of the system This is an advanced approach to make better sense out of engineered systems and help equip managers, operators, engineers, regulators and society to cope with such systems more effectively. This systems ‘sense making’ consists of placement of items into frameworks, comprehending, constructing meaning, anticipating, interacting in pursuit of understanding, patterning, and redressing surprise. The goal of this ‘sense making’ process is to help better understand the Quality and Safety associated with Engineered Systems to lessen their potentials for ‘revenge’ effects (unintended consequences) and to increase their potentials for important improvements in the quality of life. Human and Organizational Factors There are many different ways to classify and characterize Human and Organizational Factors (HOF). Popular classifications include mode (errors of omission and commission) and task performance (rule based, skill based, and knowledge based) (Rasmussen, 1982; 1983). The method developed in this Appendix is based on a study of more than 600 well documented cases of major accidents involving marine systems (Moore 1993; 1994; Moore and Bea, 1993a; 1993b; 5 1993c; Bea, 1994a; Gates, 1989; Wagenaar and Groeneweg, 1987; Gates, 1989; Bea, et al, 1997; Lancaster, 1996; U. S. Coast Guard, 1995; Nagendran, 1994; Perrow, 1984; Pate-Cornell, 1990; Pate-Cornell and Bea 1989; 1992). The taxonomy (classification system) developed as a result of this work is one that addresses the primary way (mode) in which HOF malfunctions or flaws develop. Most importantly, this taxonomy is focused on definition of malfunction developments that can be remedied. In order to effectively combat the risk of HOF malfunctions, it is important to analyze these malfunctions to determine answers to the how’s and why’s of their occurrence. Analyses such as these have been in progress for quite some time in the psychology and cognitive science communities (Rasmussen, Leplat, 1987; Reason, 1990). As will be discussed later, such engineering - technological fields as the aviation and nuclear power industries have taken the theoretical aspects of this knowledge and put them to practical use. From these primary sources, one can build an analytical model for HOF malfunctions (errors) that not only accounts for differences in behavior between individuals, but also addresses the extensive list of performance shaping factors which affect the base behavioral characteristics (Williams, 1988; Gertman and Blackman, 1994; Center for Chemical Process Safety, 1994; Boniface, 1996; Boniface and Bea, 1996a; 1996b; Woodson, Tillman, and Tillman, 1981). This discussion will start with a description of HOF malfunctions: a deviation from acceptable or desirable practice on the part of an individual (human malfunctions) or group of individuals (organizational malfunctions) that can result in unanticipated and/or undesirable results (Stamler, 1993). These HOF malfunctions (commonly termed ‘human errors’) can take active (errors of commission) or inactive (errors of omission) forms (Reason, 1990). HOF malfunctions are a result, not the cause (Woods, 1990; 1994). The key questions in understanding (and therefore combating) HOF malfunctions are the how’s and why’s of HOF malfunctions. How do these errors occur? Why do errors occur in some situations and not others? Why has the introduction of automation not alleviated the risks of HOF malfunctions? To address these and other questions, one must better understand both human nature and the workings of the human mind, which requires some knowledge of psychology and cognitive science (Follett, 1924; Mandler, 1984; McCormick and Sanders, 1982; Allport, 1985; Winograd and Flores, 1986; Meister and Rabideau, 1965; Katz and Kahn, 1966; Meister, 1971; Miller, 1978; Leplat and Rasmussen, 1984; Rasmussen, Leplat, 1987; Hawkins, 1987; Kantowitz and Sorking, 1983; Rasmussen, 1980; 1982; 1983; 1986; 1995; 1996; Reason, 1990a; 1990b, 1991, 1997; Norman, 1992; Sanders and McCormick, 1993; Groeneweg, 1994; Kirwan, 1994; Bogner, 1994; Cook and Woods, 1994; Dorner, 1996). Operator performance This discussion is based primarily on the concepts developed and applied by Reason (1990a). From these principles, a Root Causes Analysis system is developed that will allow for a simple yet powerful collection and analysis of data. It is important to note that the mechanisms and theories put forth by Reason are not the only possible explanation. The literature has a wide variety of theories to explain why and how humans make errors (e.g. Center for Chemical Process Safety, 1994; Kirwan, 1994; Fleishman, et al 1990). The advantages of Reason’s model as applied here lies in its simple yet powerful description of human and organizational performance. It combines the cognitive aspects of the knowledge 6 based modeling system with a much needed description of the non-cognitive aspects of the tasknetwork modeling. Although more detailed and intricate models may seem more accurate, the high levels of human variability minimize their advantage over the more simple methods chosen. Furthermore, the analysis of reliability in the engineering/technology vocations typically seek only order of magnitude estimations of errors, rather than exact descriptions. In order to answer the above questions, we started with an analysis of how humans act and perform the myriad of tasks and sub-tasks that make up everyday life. There are three main phases of actions: 1) evaluation, 2) goal-setting, and 3) execution (Reason, 1990a). These three phases can then be subdivided into the seven stages of action as shown (Fig. A-4). Within such a framework, all actions can be categorized, and the problems associated with human and organizational errors studied. As described by Rasmussen (1982, 1983), all human tasks can be classified by three performance levels; skill-based (SB), rule-based (RB), and knowledge-based (KB). In order to differentiate between these levels and understand their meaning and importance, a review of the cognitive science literature in this area was required, which resulted in an understanding of the shaping factors that play such an important role in the occurrence of errors and accidents. A description of these performance levels therefore precedes a detailed discussion of the three performance levels. The three task levels; knowledge-based, rule-based, and skill-based, are described below, in order of decreasing cognitive demand. Knowledge-based performance is the most cognitively demanding level. At this stage there are no pre-planned actions which can be called upon, due to the novelty of the situation. Instead, stored knowledge and sensory inputs are analyzed to determine and develop a requisite plan of action. This places the limited cognitive capacity under an obvious strain, thus requiring the full attention of the individual. Examples of such performance include goal setting, planning, problem solving, and response to unusual situations or emergencies. Errors at this level originate from resource limitations (attention, cognition, and/or time), and incomplete or incorrect knowledge. Rule-based performance is the next cognitive level. This class involves responding to familiar problems to which stored, standardized rules can be applied. This stage Fig. A.4: Seven Stages of Action with ‘shortcuts’ based on Skill-Based (SB) and Rule-Based Performance Levels; Knowledge- Based (KB) Performance is based on use of all seven stages of action 7 lends itself to lower cognition levels in that the only demand on these resources is in the selection of the rule that applies to the particular set of calling conditions. The four criteria for rule selection are: 1) be recallable, 2) be applicable to context, 3) have expected utility, and 4) be executable. Errors in rule-based performance stem from the improper application of a rule, be it from incorrect selection or incorrect procedural recall. The least cognitively demanding level is skill-based performance. At this level, calling conditions have been called so often that knowledge retrieval and action are virtually automatic. Indeed, actions at this level are so automatic (and therefore efficient), that, should the subject exert conscious attention at the wrong stage, discomfort is felt and the likelihood of error is increased. Examples of skill-based behavior include driving, eating, and walking under normal conditions. With this description of human cognition, the task breakdown summarized in Fig. A.4 can be modified to account for the shortcuts used in rule-based (RB) and skill-based (SB) behavior (Dougherty and Collins, 1996). Repetition (practice) of various tasks, including knowledge retrieval, will increase their familiarity and therefore allow for the development of standardized rules to deal with them. As repetition increases, these rule-based behaviors require less and less attention, finally becoming the automatic skill-based form. As a rule, the mind will always attempt to use the lowest level possible, in order to conserve attention resources. In fact, the shift to rule-based and knowledge-based behavior will only occur upon detection of a problem. Furthermore, only knowledge-based performance requires plan/goal formulation, which provides a further conservation of attentive resources. As defined by Reason (1990a), error forms are recurrent types of fallibility that appear in all levels of cognitive activity. These error forms are tied to the mechanics of the cognitive process described previously, namely similarity and frequency biases. The incorrect selections (knowledge and/or actions) are thus a result of under specification of either stored knowledge and/or calling conditions (the under specification of knowledge can also be seen as an over specification of the calling conditions, depending on the context.). Being tied to these basic cognitive mechanisms, they pervade all categories of the thought processes and are more general in nature than the error types, which are described next (Table A-1). Error types differ from error forms in that they are tied to the individual levels and stages of cognition, while the latter are global in nature. There are three stages involved in carrying out a task: Planning, Storage and Execution (Table A.1) with the corresponding error types of mistakes, lapses, and slips (Reason, 1990a). These three primary error types relate to the potential ways a given action can go wrong and can be allied with the three performance levels as shown in Table A.2. Table A.2 is especially important in that it introduces the second of the two reasons why mishaps occur - violations (Dougherty, 1995). These forms will be discussed in detail later. For now, they can be viewed performance specifications of the social setting. 8 Table A-1: Cognitive stages and Primary error types Cognitive Stage Primary Error Type Planning Mistakes Storage Lapses Execution Slips as being variations from the accepted Table A.2: Performance levels and mishap classes Performance Level Error Type Violation Type Skill-based level Slips and lapses Erroneous or Unintended Rule-based level Rule-based mistakes Routine Knowledge-based level Knowledge-based mistakes Exceptional When an action is in error due to a faulty plan, it is identified as a mistake. Here, the plan is remembered and executed correctly, but the desired outcome does not occur due to faulty goal selection and/or poor planning. Lapses are defined as those errors which result from a failure in the storage of the action plan. This breakdown can either occur in the encoding of the plan as it is cached in a buffer store or in the subsequent retrieval when the action is called upon or scheduled. These errors are fairly well hidden, and tend to be identified only by the person who experiences them. Slips are errors in the plan execution phase. The plan is sound and is remembered correctly. Due to variety of cognitive causes, however, things do not go as planned. There are many causes of slips, ranging from inattention, to distraction, to substitution of one (incorrect) familiar action for another. Discussions of how cognitive actions deviate from acceptable parameters, however, would be incomplete without consideration of violations. These deviations differ from errors as follows. Errors are defined as the inadvertent ‘straying’ of actions from the action sequence to the intended outcome. Violations, on the other hand, are defined as ‘deliberate- but not necessarily reprehensible- deviations from those practices deemed necessary to maintain in the safe operation of a potentially hazardous system’. As discussed by Reason (1980), this delineation of errors versus violations can perhaps best be demonstrated by the cognitive source of errors versus the social psychological sources found in violations. Violations can be broken down into four categories: erroneous/unintended actions, routine violations, exceptional infractions, and sabotage. This categorization is important because different types of measures and means should be used to reduce their incidence and effects. The three primary violation types are related to the three performance levels (Table A.2). Here, the differentiation lies not with the actual performance, but rather with the intentionally (and thus cognitive load) of the action. Erroneous or unintended violations are therefore those violations for which there were no prior intention to commit. Routine violations, on the other hand, are habitual infractions which, while at least initially intentional, have become so ingrained into the normal practice that they are usually accepted as part of the normal rule-based behavior (Dougherty, 1995). These violations arise from two main factors; the tendency to take the path of least resistance, and the existence of an environment that was largely indifferent. Finally, exceptional violations are those which are individually chosen at the time of the violation. These result from the existence of such flaws as design and/or organizational ‘double-binds’, where the decision-maker is put in a position where he/she views the violation as being the optimal 9 decision. These violations complete the ways that the evaluation and goal-setting phases can go wrong. In virtually all tasks, individuals go through some form of self-monitoring to assess the adequacy of actions. These checks can range from spot-checks during problem solving, to the continuous feedback and correction. In self-monitoring, the individual compares his perceptions of performance with the milestones and goals set in the planning stage. If discrepancies and/or shortcomings are noted, another decision-making process must ensue, and new goals chosen, new plans/actions used, or acceptance of flawed performance made. This decision-making process and subsequent actions are themselves subject to errors. While these subsequent error rates do vary depending upon the particular situation and performance shaping factors, it has been shown that the higher the cognitive level at which they operate (i.e.- knowledge-based versus skill-based), the more likely they are to be erroneous themselves. Given the two types of checks that can be made for a given action/process, it has been shown that a subject is far more likely to look for errors in plan execution than in goal setting or plan formulation and storage. Not only is it often difficult to assess the adequacy of a goal or plan prior to task completion, but it is almost unheard of for a subject to call into question the basic goals and assumptions used, as these tend to be based upon the experience and personality of the person involved. In most circumstances, the goal as set and the formulated plan are accepted as being correct without question, and checks are made for all subsequent stages. Reason (1990a) has broken down self-monitoring into three types: the standard check, direct error hypotheses formulation, and error suspicion. The standard check (SC) is a general progress check that is cyclic in nature and does not depend on the previous work. Here, the subject commences a check based upon the time elapsed and/or number of operations since the last check. Direct error hypotheses (DEH), on the other hand, are triggered by the detection of a perceived error, although not necessarily immediately after presumed error commission. This usually arises from signals provided by the subjects external surroundings. Error suspicion (ES) differs from DEH in that there is no specific error to trigger the process. Instead, a feeling that something is wrong is encountered. Among these three self-monitoring mechanisms, direct error hypotheses are most common, followed by error suspicion and then standard checking. Furthermore, it was found that slips were more likely to be detected than mistakes, and that the predominant detection mode for slips were direct error hypothesis episodes (Reason, 1990). Knowledge-based mistakes tended to be picked up by error suspicion conditions, while rule-based mistakes were found to be mostly the result of direct error hypothesis or error suspicion episodes. Finally, the effectiveness of error suspicion detection was found to decrease rapidly after error commission. In the second checking form, environmental error warning, the subject's external surroundings provide the indications of an error condition. Errors can be indicated by either an alarm signaling an out of parameter condition, and/or an interlock blocking further progress. These conditions can be either natural or man-made, both of which can take numerous forms. Error cues include such manifestations as physical blocking (e.g.- screen over a fan housing), geometrical constraints (e.g.- oil filter for engine will only fit in the correct direction), and checks on order (e.g.- failure to provide salt water cooling to engine will prevent starting). With judicious use of both natural and man-made error cues, the technical system designer/manager can greatly reduce the risk of human and organizational error. With such a 10 system, both the probability of failure and the costs associated with these errors (through casualty control provided by automatic shutdowns, etc.) can be minimized. However, these alarms should not be so numerous as to overwhelm and/or distract the operator with redundant or unimportant information. They should also present a complete set of data in a clear, unambiguous manner, so as to avoid causing confusion and/or mis-identification of the error(s). This information should be given in a hierarchical format, so as to allow the operator to access more detailed material if required or desired. The final checking form, external monitoring, is one often used in design and engineering tasks, although frequently ineffectively. If performed properly, however, these checks provide a powerful tool for detecting and correcting errors. Characteristics of quality external checking systems include; independence between checker and task performers, and use of expert checkers (it takes one to catch one). Perhaps the most important property of a proficient external monitoring system is the ability to identify errors in the goal selection and planning stages. Qualified, experienced, independent checkers are far more likely to identify errors in the objectives and performance strategies than any other checking form. Dorner (1989) has developed some important concepts regarding ‘the logic of failure.’ Dorner contends that people have extreme difficulties in dealing with complex systems because of their many inter-acting and inter-dependent variables and their intransparence. Dorner’s extensive experimental observations of people’s failures with complex systems are summarized in Table A.3. Table A.3: Failures to deal successfully with complex systems • • • • • • • • • • • • • • • • • • • slowness  of  thinking   slowness  of  knowledge  storing   act  without  prior  analysis   do  not  anticipate  side  effects   assume  absence  of  negative  effects   blind  to  changes   prone  to  cyclical  actions   cognitive  vagabonding   shift  responsibilities   low  capacities  to  tolerate  uncertainties   • over-­‐steering  dynamic  systems   time  pressures   violations   memory  limitations   reductive  analysis  (single  causes)   contradictory  goals   wrong  models   active  treated  as  passive   extrapolations  based  on  present   conditions   incapacity  to  deal  with  nonlinear   time  configurations   Key observations that came from these experiments were: • • • • “reality  models  can  be  right  or  wrong,  complete  or  incomplete.  Most  are  wrong  and   incomplete.”   “contradictory  goals  are  the  rule,  not  the  exception.”   “most  approach  the  continuing  need  for  problem  solving  in  complex  systems  with  a   repair  service  behavior;  fix  it  once  for  all.  But,  the  problems  keep  occurring.”     “people  are  far  more  able  to  recognize  and  deal  with  arrangements  in  space  than  in   time.”     11 • “we  can  not  interpret  numbers  based  on  their  size;  to  understand  what  they  mean,  we   must  understand  the  process  that  produced  them.”   Dorner’s experimental observations lead to development of a five step process to deal with complex systems: • • • • • Formulate  goals,   Formulate  models  and  gather  information,   Predict  and  extrapolate  effects,   Plan  actions,  decisions,  and  executions,  and   Review  effects  of  actions  and  revise  strategy.   Dorner’s advice in dealing with complex systems is to know how the goal variables depend on the other variables in the system, to know how individual components fit into the hierarchy of the system, and to know how component parts of a system can be broken into elements. Senders and Moray (1990) review of the taxonomies of human error suggest three primary types of human error taxonomies: • • • Phenomenological – taxonomies which classify errors in a behaviorally descriptive way, Cognitive – taxonomies which reflect assumptions about underlying cognitive processes, and Deep-Rooted-Tendency – taxonomies which emphasize human higher-order biases and propensities Senders and Moray (1990) distinguish two categories of human error: 1) endogenous, and 2) exogenous. Endogenous errors are those developed by an individual. Exogenous errors are those that arise outside of the individual or within the ‘environment.’ Swain and Guttman (1983) advanced a behavioral taxonomy that includes: errors of omission, errors of commission, sequence errors, and timing errors. Fitts and Jones (1961) developed a taxonomy based on their analysis of some 460 aircraft incidents that included six major categories: substitution errors, adjustment errors, forgetting errors, reversal errors, unintentional activation, inability to reach. Meister (1971) suggests that errors be classified according to causes including: systems induced errors, design induced errors, and operator induced errors. A primary contribution of this taxonomy is classifying errors in terms of the major stages of a system development including design, production, and operations. Rasmussen (1987) observes that human errors are events in the causal path that leads to system malfunctions (TableA.4). This observation is mirrored by Woods (1990): errors are results, not causes. Rasmussen contends that human errors cannot be defined in isolation from the systems in which they occur and that they must always be referenced with respect to human intentions and expectations. Rasmussen proposed the multifaceted taxonomy for description and analysis of events involving human malfunctions (instead of errors) summarized in Table A.4. 12 Table A.4: Rasmussen’s taxonomy for analysis of events involving human malfunctions Performance Factors • subjective goals and intentions • mental load and resources • affective factors • causes • external events • excessive demands • incapacitation • intrinsic variability Situation Factors • task characteristics • physical environment • work time characteristics • Mechanisms • discrimination • information processing • recall • inference External Malfunctions • task not performed • commission of erroneous act • commission of extraneous act • accidental timing of faults Internal Malfunctions • detection • identification • decision • action Personnel Task Factors • equipment design • procedure design • fabrication • installation • inspection • operation • test and calibration • maintenance, repair • logistics • administration • management Organizational performance Studies of HRO (Higher Reliability Organizations) (Roberts, 1989-1994; Roberts, et al, 19891995; Weick, 1979-1995b; Weick, et al, 1993-1999; Wenk, 1988; 1986; 1998) has shed some light on the factors that contribute to errors made by organizations and risk mitigation in HRO. HRO are those organizations that have operated nearly error free over long periods of time. A variety of HRO ranging from the U. S. Navy nuclear aircraft carriers to the Federal Aviation Administration Air Traffic Control System have been studied. The HRO research has been directed to define what these organizations do to reduce the probabilities of serious errors (Roberts, 1989; Roberts and Rousseau, 1989). Reduction in error occurrence is accomplished by the following: • • • • • • Command by exception or negation, Redundancy, Procedures and rules, Training, Appropriate rewards and punishment Ability of management to "see the big picture". Command by exception (management by exception) refers to management activity in which authority is pushed to the lower levels of the organization by managers who constantly monitor the behavior of their subordinates. Decision making responsibility is allowed to migrate to the persons with the most expertise to make the decision when unfamiliar situations arise (employee empowerment). Redundancy involves people, procedures, and hardware. It involves numerous individuals who serve as redundant decision makers. There are multiple hardware components that will permit the system to function when one of the components fails. 13 Procedures that are correct, accurate, complete, well organized, well documented, and are not excessively complex are an important part of HRO. Adherence to the rules is emphasized as a way to prevent errors, unless the rules themselves contribute to error. HRO develop constant and high quality programs of training. Training in the conduct of normal and abnormal activities is mandatory to avoid errors. Establishment of appropriate rewards and punishment that are consistent with the organizational goals is critical. Lastly, Roberts and Roberts, et al. define HRO organizational structure as one that allows key decision makers to understand the big picture. These decision makers with the big picture perceive the important developing situations, properly integrate them, and then develop high reliability responses. In recent organizational research reported by Roberts and Libuser (1993), they analyzed five prominent failures including the Chernobyl nuclear power plant, the grounding of the Exxon Valdez, the Bhopal chemical plant gas leak, the mis-grinding of the Hubble Telescope mirror, and the explosion of the space shuttle Challenger. These failures were evaluated in the context of five hypotheses that defined "risk mitigating and non-risk mitigating" organizations. The failures provided support for the following five hypotheses. Risk mitigating organizations will have extensive process auditing procedures. Process auditing is an established system for ongoing checks designed to spot expected as well as unexpected safety problems. Safety drills would be included in this category as would be equipment testing. Follow ups on problems revealed in prior audits are a critical part of this function. Risk mitigating organizations will have reward systems that encourage risk mitigating behavior on the part of the organization, its members, and constituents. The reward system is the payoff that an individual or organization gets for behaving one way or another. It is concerned with reducing risky behavior. Risk mitigating organizations will have quality standards that meet or exceed the referent standard of quality in the industry. Risk mitigating organizations will correctly assess the risk associated with the given problem or situation. Two elements of risk perception are involved. One is whether or not there was any knowledge that risk existed at all. The second is if there was knowledge that risk existed, the extent to which it was acknowledged appropriately or minimized. Risk mitigating organizations will have a strong command and control system consisting of five elements: a) migrating decision making, b) redundancy, c) rules and procedures, d) training, and e) senior management has the big picture. Weick, Sutcliffe, and Obstfeld (1998) have extended these concepts to characterize how organizations can organize for high reliability. Their extensive review of the literature and studies of HRO indicate that organizing in effective HRO’s is characterized by: Preoccupation with failure – any and all failures are regarded as insights on the health of a system, thorough analyses of near-failures, generalize (not localize) failures, encourage selfreporting of errors, and understand the liabilities of successes. 14 Reluctance to simplify interpretations – regard simplifications as potentially dangerous because they limit both the precautions people take and the number of undesired consequences they envision, respect what they do not know, match external complexities with internal complexities (requisite variety), diverse checks and balances, encourage a divergence in analytical perspectives among members of an organization (it is the divergence, not the commonalties, that hold the key to detecting anomalies). Sensitivity to operations – construct and maintain a cognitive map that allows them to integrate diverse inputs into a single picture of the overall situation and status (situational awareness, ‘having the bubble’), people act thinkingly and with heed, redundancy involving cross checks, doubts that precautions are sufficient, and wariness about claimed levels of competence, exhibit extraordinary sensitivity to the incipient overloading of any one of it members, sensemaking. Commitment to resilience – capacity to cope with unanticipated dangers after they have become manifest, continuous management of fluctuations, prepare for inevitable surprises by expanding the general knowledge, technical facility, and command over resources, formal support for improvisation (capability to recombine actions in repertoire into novel successful combinations), and simultaneously believe and doubt their past experience. Under-specification of structures – avoid the adoption of orderly procedures to reduce error that often spreads them around, avoid higher level errors that tend to pick up and combine with lower level errors that make them harder to comprehend and more interactively complex, gain flexibility by enacting moments of organized anarchy, loosen specification of who is the important decision maker in order to allow decision making to migrate along with problems (migrating decision making), move in the direction of a garbage can structure in which problems, solutions, decision makers, and choice opportunities are independent streams flowing through a system that become linked by their arrival and departure times and by any structural constraints that affect which problems, solutions and decision makers have access to which opportunities. The other side of this coin are LRO (Lower Reliability Organizations). Weick, Sutcliffe, and Obstfeld observe that these non-HRO’s are characterized by a focus on success rather than failure, and efficiency rather than reliability. In non-HRO the cognitive infrastructure is underdeveloped (Wagennar, et al, 1990), failures are localized rather than generalized, and highly specified structures and processes are put in place that develop inertial blind spots that allow failures to cumulate and produce catastrophic outcomes. Efficient organizations practice stable activity patterns and unpredictable cognitive processes that often result in errors; they do the same things in the face of changing events, these changes go undetected because people are rushed, distracted, careless, or ignorant. In non-HRO expensive and inefficient learning and diversity in problem solving are not welcomed. Information, particularly ‘bad’ or ‘useless’ information is not actively sought, failures are not taken as learning lessons, and new ideas are rejected. Communications are regarded as wasteful and hence the sharing of information and interpretations between individuals is stymied. Divergent views are discouraged, so that there is a narrow set of assumptions that sensitize it to a narrow variety of inputs. In LRO success breeds confidence and fantasy, managers attribute success to themselves, rather than to luck, and they trust procedures to keep them appraised of developing problems. Under the assumption that success demonstrates competence, LRO drift into complacency, inattention, and habituated routines which they often justify with the argument that they are eliminating unnecessary effort and redundancy. Often down-sizing and out-sourcing are used to further the 15 drives of efficiency and insensitivity is developed to overloading and its effects on judgment and performance. Redundancy is eliminated or reduced in the same drive resulting in elimination of cross checks, assumption that precautions and existing levels of training and experience are sufficient, and dependence on claimed levels of competence. With outsourcing, it is now the supplier, not the buyer, that must become preoccupied with failure. But, the supplier is preoccupied with success, not failure, and because of low-bid contracting, often is concerned with the lowest possible cost success. The buyer now becomes more mindless and if novel forms of failure are possible, then the loss of a preoccupation with failure makes the buyer more vulnerable to failure. LRO tend to lean toward anticipation of ‘expected surprises,’ risk aversion, and planned defenses against foreseeable accidents and risks; unforeseeable accidents and risks are not recognized or believed. Weick, Sutcliffe, and Obstfeld finally characterize LRO as: “organizations in which people shuffle papers and lose a few, attend meetings and solve nothing, catch airplanes and miss connections, conduct briefings and persuade no one, evaluate proposals and miss the winners, and meet deadlines for projects on which the plug has been pulled.” Haber, et al (1991) and Wu, et al (1989) have advanced the concepts of HRO in a development applied to the operating safety of nuclear power plants. Their approach is focused on five sets of organizational factors that address: • • • • • Communications, Organizational culture, Decision making (including problem solving), Standardization of work processes, and Management attention, involvement, and oversight The discriminating elements involved in each of these five sets of factors are developed. A protocol was developed to allow assessors to observe the management and operations of a given power plant and develop gradings of the factors. These gradings were then used to modify plant operator error rates (influence factors) in an event-tree, fault-tree based probabilistic risk analysis model of the ‘critical’ power plant operations (that could lead to a core meltdown). This approach allows organizational influences to be integrated into the probabilistic risk analysis results. A demonstration exercise was conducted with a power plant to illustrate how the approach might be used (Wu, et al, 1989). It was concluded that the approach was workable and produced useable results. Bellamy, et al, (1986, 1990), Bellamy and Geyer (1992), and Hurst, et al (1989-1992) addressed organizational, management and human factors in quantified risk assessment for the U. K. Health and Safety Executive. The objective of this work was to develop a method to incorporate organizational influences in quantified risk analyses (QRA). Bellamy and Geyer develop the basis for a system that is identified as MANAGER. MANAGER can be used in modification of risk audits. At the core of this approach is a ‘sociotechnical pyramid’ that was adapted from Hurst et al (1989). This approach focused on five ‘levels:’ 16 System climate – reflecting technological know-how, lessons learned from previous incidents, industry norms and standards, legislation and regulatory systems, economic climate, location, nature of hazard, etc. Organization and management – reflecting establishment of organizational goals, maintaining and improving standards, formation and organization of groups, coordination, allocation of resources, data gathering, determination of resource allocations, and definition of lines of responsibility and accountability. Communication, information, and feedback control – reflecting formal and informal communications, frequency and duration, documentation, information availability, equipment availability, data availability, supervision, and individual – group performance measures. Operator reliability – reflecting task demand characteristics, operator understanding and skills, quality of man-machine interface design, stresses, social effects, environment, and access to information. Engineering reliability - reflecting hardware and software of the facility and the process. An extensive list of questions – considerations were developed guide development of the assessments of the levels. Grading guidelines were developed and the gradings were weighted with ‘contribution scores.’ The multiple influences were then used to modify ‘standard failure frequencies’ and these were then summed to give an overall failure frequency for the facility (Hurst, et al, 1990-1992). The approach was applied by Harrison (1992) to an existing database of failures in piping systems. It was concluded that this was a workable approach to integrate organizational factors into QRA. The report by Wright, et al (1992) continued this development with an aim of evaluating alternative approaches that would allow the use of statistical data and sociotechnical system modeling and to compare alternative sets of questions that had been developed by different organizations. Reason (1997) in expanding his work from the individual to the organization, develops another series of important insights and findings. Reason observes that all technological organizations are governed by two primary processes: production and protection. Production produces the resources that make protection possible. Thus, the needs of production will generally have priority throughout most of an organization’s life, and consequently, most of those that manage the organization will have skills in production, not protection. It is only after an accident or a near-miss that protection becomes for a short period time paramount in the minds of those that manage an organization. The history of the organization’s walk through the protection – production – time space is characterized with the black circles in Fig.A.5 (Reason, 1997). The history starts in the left-hand corner where the organization begins production with a reasonable margin of protection. As time passes, the protection is reduced in a drive for greater efficiency until a low-cost accident (or near-miss) occurs. The event leads to an improvement in protection, but again, this improvement is traded off for a production advantage until another, more serious accident occurs. Again, the level of production is increased and again the level of protection is eroded by an event free period. The end of the history is a catastrophe. Risk compensation, an exponential decay in ‘awareness’ of the lessons of the last accident or fear of the next accident, and simply increasing production without increasing protection leads to the catastrophic accident. 17 Protection Bankruptcy Parity Zone Catastrophe Production Figure A.5: Life of an organization through production – protection space (Reason, 1997) Reason observes that production and protection are dependent on the same underlying organizational processes. If priority is given to production by management and the skills of the organization are directed to maximizing production, then unless other measures are implemented, one can expect an inevitable loss in protection until significant accidents cause an awakening of the need to implement protective measures. The organization chooses to focus on problems that it always has (production) and not on problems it almost never has (major accidents). The organization becomes ‘habituated’ to the risks it faces and people forget to be afraid: “chronic worry is the price of safety.” Reason advances the following in-depth defenses for managing ‘the risks of organizational accidents’: • • • • • • creation of understanding and awareness in the organization provision of guidance on the management of active (unsafe acts) and latent (inherent weaknesses) conditions provision of warnings and alarms that will provide signals of degradations development of restoring systems (provision of damage tolerant – robust systems) utilization of safety barriers to provide early warnings to operators and managers development of procedures to contain and eliminate hazards Reason cites a number of ‘dangerous defenses’ developed by organizations in response to accidents: • • • • • • • excessively complex systems and procedures: ‘killed by their armor;’ over-automation and computation: ‘radar assisted collisions;’ excessive formal procedures: ‘violations are the only way left to do what needs to be done;’ reactive prevention: ‘causing the next accident while trying to prevent the last one,’ frequently taking the form of ‘kill the victim;’ defenses in depth: ‘dangerous concealment; too sensitive alarms: ‘cry wolf’ reactions; and fuses: ‘unnecessary complexity’ 18 Reason advances observations regarding ‘the unhappy lot of regulators:’ “Regulators tend to become reliant on the regulated to help them acquire and interpret information; consequently, they obtain filtered information, tend to sympathize with the regulated, and develop a compromised ability to identify, report, or sanction violations. The requirement for the regulator to compromise with the regulated is an enforcement pattern that is systematically generated by the structure of inter-organizational relations (Vaughn, 1996; 1997).” Two structure systems operations oriented safety management instruments are discussed by Reason: Tripod Delta (Hudson, et al, 1994; 1996a; 1996b) and Tripod Beta (Groeneweg, 1994). Both of these instruments will be discussed later in this work. As a result of a 3-year duration joint industry – government sponsored project, Moore and Bea (1993a) developed a human error safety index method (HESIM). For a given ‘system,’ an operator safety index was developed from the product of five contributing safety indices: operating team index, organizational index, performance factors index, system factors index, and environmental factors index. Based on published information on operator task error rates (e.g. Swain, 1963; 1978; Swain and Guttman, 1983), the base probability for operator error in a given task was estimated. This base probability was then modified by the product of the safety indices. An accident investigation instrument was developed that with time and application could be used to develop the operator error rates and influence factors. The organizational index included top level and middle level management influences that included: overall commitment to safety, commitment to long-term safety goals, cognizance of problems, competence to correct problems, and sufficiency of resources. HESIM was used in a detailed study of the Piper Alpha accident (Moore, Bea, 1993b; 1993c) and the Exxon Valdes grounding (Moore, 1993; 1994; Moore, Bea, 1993c; 1995). Influence diagram methods were used in an analysis of the primary tasks and elements involved in the Piper Alpha and Exxon Valdes ‘systems.’ These applications indicated that the method was workable and developed realistic results. The approach was used to study how the reliability of the systems might be improved. Murphy and Pate-Cornell (1996), and Pate-Cornell and Murphy (1996) have developed a system-action-management (SAM) approach that involves use of four models for the evaluation of the link between management factors and human actions. Three of these models attempt to represent the intentions of the organization and one is intended to address the execution of actions. The models are: • • • • Rational actor – decisions determined by the set of alternatives considered, the information available, consequences, and preferences. Bounded rationality – when an alternative that satisfies defined goal is found, the search ends without further analysis. Rule-based – organizations uses a catalogue of pre-established rules that specifies the action appropriate for each circumstance. Execution – organizations defined based on their capabilities and likelihood of error versus task demands are assessed. Murphy and Pate-Cornell cite four strategies that influence the decisions made by an organization: 19 • • • • Incentives, Resources, Information, and Change of preferences through socialization. One of the factors that is repeatedly cited in discussions concerning the influences of organizations on reliability of systems is the ‘Safety Culture’ of the organization. The safety culture is concerned with the beliefs, values, attitudes and behaviors of people in an organization (Pidgeon, 1991; Pidgeon and O’Leary, 1994). The culture of an organization reflects its history and its identity (Zohar, 1980; Meshkati, 1995). The culture of an organization is influenced by the local and national social cultures. Studies of HRO indicate that once the safety culture of an organization is or is not established, it is extremely difficult, if not impossible to change it (Roberts, 1990). The study for the Nuclear Regulatory Commission reported by Haber, et al (1991) defined 12 different ‘styles’ that characterized the safety culture of an organization. These ranged from humanistic and affiliative to perfectionistic and self-actualizing cultures. Merry (1998) defined 11 key attributes that characterized ‘World Class Safety Cultures: • • • • • • • • • • • visible leadership and commitment of top management safety role of line management strategic business importance of safety supportive organizational practices involvement of all employees learning organization safety performance measurement mutual trust and confidence between management and workforce openness of communications absence of safety versus production conflicts demonstration of care for those affected by business These attributes reflected three key aspects of the safety culture: the safety climate, the safety management, and the safety behavior. Application of these attributes to two organizations indicated that the attributes did a good job of reflecting the safety culture (Merry, 1998). Meshkati (1995) performed an extensive study of the concept of safety culture as it applied to nuclear power plants. Meshkati found that an organization’s safety culture is a system composed of behaviors, practices, policies, incentives / rewards, communications, and structural components, and that this system can not survive without interactions and harmony with the societal or national culture. Meshkati identifies the following issues that determine the safety culture of nuclear power plants: • • • • • • risk perception attitude toward work work group dynamics attitude toward technology attitude toward organization, hierarchy, procedure, and working habits attitude toward time and time of the day 20 • • • • religious duties and their effects on work achievement motivation and orientation population stereotype (e.g. color association) the ‘if it ain’t broke, don’t fix it’ attitude Risk perception is influenced or moderated by such safety culture issues. The result ‘elevates some risks to high peak and depresses other below sight.’ According to the U. S. Regulatory Commission, nuclear safety culture is a prevailing condition in which each employee is always focused on improving safety, is aware of what can go wrong, feels personally accountable for safe operation, and takes pride and ownership in the plant (General Accounting Office, 1990). Safety culture is a disciplined, crisp approach to operations by highly trained staff who are confident but not complacent, follow good procedures, and practice good team-work and effective communications. Safety culture is an insistence on a sound technical basis for actions and a rigorous self-assessment of problems (General Accounting Office, 1990). Based on the research performed by Pidgeon (1991), a safety culture can be characterized as the set of beliefs, norms, attitudes, roles, and social and technical practices that are concerned with minimizing the exposure of employees, managers, customers, and members of the public to conditions considered dangerous or injurious. Schein (1985) defines the organizational culture as a pattern of basic assumptions, invented, discovered, or developed by a given group as it learns to cope with its problems of external adaptation and internal integration that has worked well enough to be considered valid and, therefore, to be taught to new members as the correct way to perceive, think and feel in relation to those problems. Culture is a way of life of a people – the sum of their learned behavior patterns, attitudes, customs, and material goods. Gould (1981) observes that even engineering and scientific theories are strongly culturally based: “Facts are not pure and unsullied bits of information; culture also influences what we see and how we see it. Theories, moreover, are not inexorable inductions from facts. The most creative theories are often imaginative visions imposed upon facts; the source of imagination is also strongly cultural.” It is obvious that both industrial – regulatory cultures and engineering cultures exert powerful influences on the potentials for and effects of Human and Organizational Factor Malfunctions – often referred to as “Human Errors”. Taxonomies for Root Causes Analyses The foregoing background was used as a basis for development of a set of human and organizational malfunction taxonomies (classifications and descriptions) appropriate for the purposes of performing Root Causes Analyses of major failures of Engineered Systems. The taxonomies are based on studies of more than 600 well-documented accidents, disasters, and catastrophes. The proposed taxonomies are phenomenological and heuristic. The taxonomies go beyond Human and Organizational Factor malfunctions and include structure-hardware malfunctions, procedure malfunctions, and environmental influences. Other taxonomies generally associated with accident and failure investigation databases also have been reviewed and their best aspects incorporated into these taxonomies. 21 The proposed taxonomies do not define the why’s of errors. Rather, they define how’s of errors; the generic categories of actions or activities that can result in errors. This approach was taken so that when the activities or actions were identified they could be remedied or corrected. Operator Malfunctions As discussed earlier, there are many different ways to define, classify and describe operator (individual) malfunctions. Operator malfunctions can be defined as actions taken by individuals that can lead an activity to realize a lower quality than intended. These are malfunctions of commission. Operator malfunctions also include actions not taken that can lead an activity to realize a lower quality than intended. These are malfunctions of omission. Operator malfunctions might best be described as action and inaction that result in lower than acceptable quality to avoid implications of blame or shame. Operator malfunctions also have been described as mis-administrations and unsafe actions. Operator errors result from operator malfunctions. Operator malfunctions can be described by types of error mechanisms. These include slips or lapses, mistakes, and circumventions. Slips and lapses lead to low quality actions where the outcome of the action was not what was intended. Frequently, the significance of this type of malfunction is small because these actions are not easily recognized by the person involved and in most cases easily corrected. Mistakes can develop where the action was intended, but the intention was wrong. Circumventions (violations, intentional short-cuts) are developed where a person decides to break some rule for what seems to be a good (or benign) reason to simplify or avoid a task. Table A.5: Taxonomy of operator Mistakes are perhaps the most significant malfunctions because the perpetrator has limited clues that there is a problem. Often, it takes an outsider Communications – ineffective transmission to the situation to identify mistakes. of information Based on studies of available accident databases on engineered systems, and studies of case histories in which the acceptable quality of the systems has been compromised, a taxonomy of Operator malfunctions are summarized in Table A.5. The sources of mistakes or cognitive malfunctions are further detailed in TableA.6. Slips – accidental lapses Violations – intentional infringements or transgressions Ignorance – unaware, unlearned Planning & Preparation – lack of sufficient program, procedures, readiness Selection & Training – not suited, educated, or practiced for the activities Limitations & Impairment – excessively fatigued, stressed, and having diminished senses Mistakes – cognitive malfunctions of perception, interpretation, decision, discrimination, diagnosis, and action 22 Organization Malfunctions Analysis of the history of failures of engineered systems provides many examples in which organizational malfunctions have been primarily responsible for failures. Organization malfunction is defined as a departure from acceptable or desirable practice on the part of a group of individuals that results in unacceptable or undesirable results. Based on the study of case histories regarding the failures of engineered systems, studies of High Reliability Organizations (Roberts, 1990), and managing organizational risks (Reason, 1997), a classification of organization malfunctions is given in Table A.7. Table A.6: Classification of mistakes – cognitive processing errors Perception – unaware, not knowing Interpretation – improper evaluation and assessment of meaning Decision – incorrect choice between alternatives Discrimination – not perceiving the distinguishing features Diagnosis-incorrect attribution of causes and or effects The goals promulgated by an organization may Action- improper or incorrect carrying out induce operators to conduct their work in a activities manner that management would not approve if they were aware of their reliability implications. Excessive risk-taking problems are very common in highly structured systems (protected by anonymity). Frequently, the Table A.7: Taxonomy of organizational organization develops high rewards for malfunctions maintaining and increasing Production; meanwhile the organization hopes for Communications – ineffective transmission Protection (Safety): Rewarding ‘A’ while of information Hoping for ‘B’. The formal and informal Culture – inappropriate goals, incentives, rewards and incentives provided by an values, and trust organization have a major influence on the Violations – intentional infringements or performance of operators and on the transgressions reliability of ocean systems. Ignorance – unaware, unlearned Several examples of organizational malfunctions recently have developed as a result of efforts to down-size and out-source as a part of re-engineering organizations. Loss of corporate memories (leading to repetition of errors), creation of more difficult and intricate communications and organization interfaces, degradation in morale, unwarranted reliance on the expertise of outside contractors, cut-backs in quality assurance and control, and provision of conflicting incentives (e.g. cut costs, yet maintain quality) are examples of activities Planning & Preparation – lack of sufficient program, procedures, readiness Structure & Organization – ineffective connectedness, interdependence, lateral and vertical integration Monitoring & Controlling – inappropriate awareness of critical developments and utilization of ineffective corrective measures Mistakes – cognitive malfunctions of perception, interpretation, decision, discrimination, diagnosis, and action 23 that have lead to substantial compromises in the intended quality of systems. Experience indicates that one of the major factors in organizational malfunctions is the culture of the organization. Organizational culture is reflected in how action, change, and innovation are viewed; the degree of external focus as contrasted with internal focus; incentives provided for risk taking; the degree of lateral and vertical integration of the organization; the effectiveness and honesty of communications; autonomy, responsibility, authority and decision making; rewards and incentives; and the orientation toward the quality of performance contrasted with the quantity of production. The culture of an organization is embedded in its history. Structure and Hardware malfunctions Human malfunctions can be initiated by or exacerbated by poorly engineered systems and procedures that invite errors. Such systems are difficult to construct, operate, Table A.8: Taxonomy of structure & equipment and maintain. Table 3.8 summarizes a malfunctions classification system for hardware (equipment, structure) related Serviceability – inability to satisfy intended and malfunctions. required purposes for intended, expected, and New technologies compound the problems unexpected, unintended (accidental) conditions of latent system flaws. Complex design, Safety – excessive threat of harm to life and the close coupling (failure of one component environment, demands exceed capacities, Risks leads to failure of other components) and of major accidents that are not ‘acceptable’, severe performance demands on systems ‘tolerable’, and ‘As Low As Reasonably increase the difficulty in controlling the Practicable.’ impact of human malfunctions even in Durability – occurrence of unexpected decay and well operated systems. degradation, maintenance and less than expected Emergency displays have been found to useful life give improper signals of the state of the systems. Land based industries can Compatibility – unacceptable and undesirable spatially isolate independent subsystems economic, environmental, productivity, schedule, whose joint failure modes would aesthetic, and public – government approval constitute a total system failure. System characteristics malfunctions resulting from complex designs and close coupling are more apparent due to spatial constraints onboard systems. The field of ergonomics has largely developed to address the human – machine or system interfaces. Specific guidelines have been developed to facilitate the development of people friendly systems. The issues of system Robustness (defect or damage tolerance), design for constructablity, and design for IMR (Inspection, Maintenance, Repair) are critical aspects of engineering systems that will be able to deliver acceptable quality. Design of the system to assure robustness is intended to combine the beneficial aspects of redundancy, ductility, correlation and excess capacity (it takes all four). The result is a defect and damage tolerant system that is able to maintain its serviceability characteristics in the face of HOF. This has important ramifications with regard to structural design criteria and guidelines. Design for constructability is design to facilitate construction, taking account of worker qualifications, capabilities, and safety, environmental 24 conditions, and the interfaces between equipment and workers. Design for IMR has similar objectives. Table A.9: Taxonomy of procedure and software malfunctions Procedure & Software Malfunctions Incorrect - faulty Inaccurate - untrue Based on the study of procedure and software Incomplete - lacking the necessary parts related problems that have resulted in failures of engineered systems, Table A.9 summarizes a Excessive Complexity - unnecessary classification system for procedure or software intricacy malfunctions. These malfunctions can be Poor Organization - dysfunctional embedded in engineering design guidelines and structure computer programs, construction specifications, and operations manuals. They can be embedded in Poor Documentation - ineffective how people are taught to do things. With the information recording and transmission advent of computers and their integration into many aspects of the design, construction, and operation of engineered systems, software errors are of particular concern because the computer is the ultimate fool. Software errors in which incorrect and inaccurate algorithms were coded into computer programs have been at the root cause of several major failures of systems. Guidelines have been developed to address the quality of computer software for the performance of finite element analyses (Basu, Kirkhope, Srinivasan, 1996a; 1996b). Extensive software testing is required to assure that the software performs as it should and that the documentation is sufficient (Bea, et al, 1994). Of particular importance is the provision of independent checking procedures that can be used to validate the results from analyses. High quality procedures need to be verifiable based on first principles, results from testing, and field experience. Given the rapid pace at which significant industrial and technical developments have been taking place, there has been a tendency to make design guidelines, construction specifications, and operating manuals more and more complex. Such a tendency can be seen in many current guidelines used for design of engineered systems. In many cases, poor organization and documentation of software and procedures has exacerbated the tendencies for humans to make errors. Simplicity, clarity, completeness, accuracy, and good organization are desirable attributes in procedures developed for the design, construction, and maintenance, and operation of systems. Environmental Influences Environmental influences can have important affects on the performance characteristics of individuals, organizations, hardware, and software. Environmental influences include: • External (e.g. wind, temperature, rain, fog, time of day), • Internal (lighting, ventilation, noise, motions), and • Sociological factors (e.g. values, beliefs, taboos). All three of these environmental influences can have extremely important effects on error rates. 25 References Adrian, J. J. (1992): “Total Productivity and Quality Management,” Concrete Construction, American Concrete Institute, New York. Allen D. E. (1984): "Structural Failures Due to Human Error - What Research To Do?" Risk, Structural Engineering, and Human Errors, Proceedings of a Symposium on Structural Technology and Risk, Grigoriu, N. U., (Ed.), University of Waterloo, Canada. Allen, D. E. (1979): "Errors in Concrete Structures," Canadian J. of Civil Engineering, Vol. 6, Toronto, Ontario, Canada, Allinson, R. E. (1993): Global Disasters - Inquiries in Management Ethics, Prentice Hall, New York, NY. Allport, G. W. (1985) “The Historical Background of Social Psychology,” Handbook of Social Psychology, G. Lindzey and E. Aronson (Eds.), Vol. 1, Random House, New York. American Bureau of Shipping (1996): The Human Element in Safety at Sea, An Essay Symposium, Surveyor, Sept., Vol. 27, No. 3, New York, NY. American Bureau of Shipping (1998): The Application of Ergonomics to Marine Systems, Guidance Notes, New York. American Petroleum Institute (1993a): Recommended Practice for Planning, Designing, and Constructing Fixed Offshore Platforms-Load and Resistance Factor Design, API RP 2A, Washington, DC. American Society of Testing and Materials (1988): Standard Practice for Human Engineering Design for Marine Systems, Equipment and Facilities, Standard F1166-95a (updated 1995), West Conshohocken,PA. Andersen, L. B. (1998): “Stochastic Modeling for the Analysis of Blowout Risk in Exploration Drilling,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Andersen, R. S., et. al. (1983): "Risk Analysis in Offshore Development Projects," SINTEF Report, Norwegian Institute of Technology, Trondheim, Norway. Ang, A. H-S., and Tang, W. H. (1975): Probability Concepts in Engineering Planning and Design, Vol. 1 and Vol. 2, John Wiley & Sons, New York, NY. Apostolakis, G. E., Mancini, G., van Otterloo, R. W., and Farmer, F. R. (Eds.) (1990): Reliability Engineering & System Safety, Elsevier, London. Arafah, A. (1986): "Integration of Human Error in Structural Reliability Models", Ph. D. Dissertation, Univ. of Michigan, Civil Eng. Dept., Ann Arbor, Michigan. Armstrong, M. E. (1989): “Human Factors in Incident Investigation,” Proceedings of the 33rd Human Factors Society Annual Meeting, Santa Monica, California, Human Factors Society, Inc., New York. Arnold, K. E., Bresler, R. A., Sikes, C. T. (1995): An Engineering Contractor’s Perspective on API RP 75 and RP 14J, Proceedings of the Offshore Technology Conference, OTC 7735, Society of Petroleum Engineers, Richardson, TX, 1995. 26 Aven, T. (1992): Reliability and Risk Analysis, Elsevier Applied Science, London, UK. Aven, T., and Pitblado, R. (1998): “On Risk Assessment in the Petroleum Activities on the Norwegian and UK Continental Shelves,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Aven, T., and Porn, K. (1998): “Expressing and Interpreting the Results of Quantitative Risk Analysis: Review and Discussion,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Ball, P. (1991): The Guide to Reducing Human Error in Process Operations, Safety and Reliability Directorate, AEA Technology Report No. SRD R484, Warrington, England. Barnes, M., Bradley, P. A., and Brewer, M. A. (1993): “Software Reliability Assessment,” Proceedings of the U. S. Nuclear Regulatory Commission Twenty-First Water Reactor Safety Information Meeting, U. S. Nuclear Regulatory Commission, Washington, DC. Baron, S., Kruser, D. S., and Huey, B. M. (1990): Quantitative Modeling of Human Performance in Complex, Dynamic Systems, Panel on Human Performance Modeling, Committee on Human Factors, National Research Council, Commission on Behavioral and Social Sciences and Education, Nat. Academy Press, Washington, D. C. Barrett, F. J. (1998): “Creativity and Improvisation in Jazz and Organizations: Implications for Organizational Learning,” Organizational Science, Vol. 9, No. 5. Barriere, M. T., Luckas, W. J., Cooper, S. E., Wreathall, J., Bley, D. C., and Brown, W. S. (1993): "Implications of an HRA Framework for Quantifying Human Acts of Commission and Dependency: Development of a Methodology for Conducting an Integrated HRA/PRA," Proc. U. S. Nuclear Regulatory Commission Twenty-first Water Reactor Safety Information Meeting, Vol. 1, NUREG/CP-0133, Washington, DC. Bartholomew, H. G. (1995): “MMS Perspective on API RP 75 and API RP 14J,: Proceedings of the Offshore Technology Conference, OTC 7733, Society of Petroleum Engineers, Richardson, TX. Basra, G. and Kirwan, B. (1998). “Collection of Offshore Human Error Probability Data,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Basu, R., Kirkhope, K., and Srinivasan, J. (1996a): “Assuring Quality and Reliability of Ship Structure Finite Element Analysis,” Proceedings Human and Organizational Error in Marine Structures, A Quest for Quality in Design, Construction, and Maintenance, Ship Structure Committee and Society of Naval Architects and Marine Engineers, Jersey City, NJ. Basu, R., Kirkhope, K., and Srinivasan, J. (1996b): Guidelines for Evaluation of Ship Structural finite Element Analysis, Ship Structure Committee Report SSC-387, Washington, DC. Bathe, K. J. (1998): “What Can Go Wrong in FEA?”, Mechanical Engineering, American Society of Mechanical Engineers, New York. Bea, R. G. (1972): The Texas Towers: A Valuable Lesson in Offshore Engineering, Report to Shell Oil Company, Houston, Texas, 1972. Bea, R. G. (1975): "Gulf of Mexico Hurricane Wave Heights." Journal of Petroleum Technology, Society of Petroleum Engineers, Richardson, TX. 27 Bea, R. G. (1990): Reliability Based Design Criteria for Coastal and Ocean Structures, National Committee on Coastal and Ocean Engineering, The Institution of Engineers, Australia, Barton, ACT. Bea, R. G. (1991): “Structural Reliability: Design and Re-qualification of Offshore Platforms,” Proceedings International Workshop on Reliability of Offshore Operations, National Institute of Standards and Technology, Gaithersburg MD. Bea, R. G, (1992): Marine Structural Integrity Programs (MSIP), Report to Ship Structure Committee, SSC-365, Washington, DC. Bea, R. G. (1993a): "Key Questions in the Reassessment & Requalification of Permanent Offshore Drilling & Production Platforms," Proceedings of the Int. Workshop on Reassessment and Requalification of Offshore Production Structures, U. S. Minerals Management Service, Herndon, VA. Bea, R. G. (1993b), “Marine Structural Integrity Programs,” Proceedings of the Ship Structures Symposium 93, Society of Naval Architects and Marine Engineers and the Ship Structure Committee, Arlington, VA. Bea, R. G. (1994a): Human and Organization Error in Design, Construction, and Maintenance of Marine Structures, Report to Ship Structure Committee, SSC-378, Washington, DC. Bea, R. G. (1994b): “Marine Structural Integrity Programs,” Journal of Marine Structures, Vol. 7, Elsevier Science Limited, England. Bea, R. G. (1994c): “Evaluation of Alternative Marine Structural Integrity Programs,” Journal of Marine Structures, Vol. 7, Elsevier Science Limited, England. Bea, R. (1995): “Evaluation of Human and Organization Factors in Design of Marine Structures: Approaches and Applications,” Proceedings 14th International Conference on Offshore Mechanics and Arctic Engineering, American Society of Mechanical Engineers, New York. Bea, R. G. (1996a): “Human and Organization Errors in Reliability of Offshore Structures,” Journal of Offshore Mechanics and Arctic Engineering, Nov. - Dec., American Society of Mechanical Engineers, New York. Bea, R. G. (1996b): “Quantitative & Qualitative Risk Analyses - The Safety of Offshore Platforms,” Proceedings of the Offshore Technology Conference, OTC Paper No. 8037, Society of Petroleum Engineers, Richardson, TX. Bea, R. G. (1996c): “A Safety Management Assessment System (SMAS) for Offshore Platforms,” Proceedings of the 1996 International Workshop on Human Factors in Offshore Operations, R. G. Bea, R. D. Holdsworth, and C. Smith (Eds.), American Bureau of Shipping, Houston, TX. Bea, R. G. (1996d): “Consideration of Human and Organization Factors in Development of Design, Construction, and Maintenance Guidelines for Ship Structures,” Proceedings Ship Structure Symposium ’96, Human and Organizational Error in Marine Structures – A Quest for Quality in Design, Construction, and Maintenance, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Bea, R. G. (1996e): “Reassessment and Requalification of Infrastructure: Application to Offshore Structures,” J. Infrastructure Systems, Vol. 2, No. 2, American Society of Civil 28 Engineers, Herndon, VA. Bea, R. G. (1997a): “Accident and Near-Miss Assessments and Reporting,” Proceedings of the 1996 International Workshop on Human Factors in Offshore Operations, New Orleans, American Bureau of Shipping, Houston, TX. Bea, R. G. (1997b): “Human and Organization Errors in Reliability of Offshore Structures,” J. Offshore Mechanics and Arctic Engineering Division, Transactions ASME, Vol. 119, New York, NY. Bea. R. G. (1998a): Load Engineering, Reliability Based Loadings for Design and Requalification of Structures, Copy Central Publishers, Berkeley, CA. Bea, R. G. (1998b): “Human and Organizational Factors in the Safety of Offshore Structures,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Bea, R. G. (1998c): “Human and Organizational Factors in the Safety of Offshore Structures,” Risk and Reliability in Marine Technology, C. Guedes Soares (Ed), A. A. Balkema Publishers, Rotterdam, The Netherlands. Bea, R. G. (1998d): “Human and Organizational Factors in Safety of Engineered Systems,” Proceedings of the American Society of Safety Engineers Region III Annual Meeting, Galveston, Texas Safety Association Professional Development Conference, Austin, TX. Bea, R. G. (1999): “A Structured Method and Software to Assess Human & Organizational Errors in the Life-Cycle Reliability of Offshore Structures,” Proceedings 18th International Conference on Offshore Mechanics and Arctic Engineering, American Society of Mechanical Engineers, New York. Bea, R. G., and Moore, W. H. (1991): "Management of Human and Organizational Error in Operational Reliability of Marine Structures," Proceedings 2nd Society of Naval Architects and Marine Engineers Offshore Symposium: Design Criteria and Codes, Houston, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Bea, R. G., and Moore, W. H. (1992): "Operational Reliability and Marine Systems,” New Challenges to Understanding Organizations, Ed. K. H. Roberts, MacMillan Publishers, New York, NY. Bea, R. G., Cornell, C. A., Vinnem, J. E., Geyer, J. F., Shoup, G. J., and B. Stahl (1992): “Comparative Risk Assessment of Alternative TLP Systems: Structure & Foundation Aspects,” Proceedings 11th International Conference on Offshore Mechanics and Arctic Engineering, Safety & Reliability Symposium, American Society of Mechanical Engineers, New York. Bea, R. G., and Moore, W. H. (1994): "Reliability Based Evaluations of Human and Organization Errors in Reassessment and Requalification of Platforms," Proceedings of International Offshore Mechanics and Arctic Engineering Conference, Safety and Reliability Symposium, Paper No. OMAE 94-1272, Houston, ASME, New York, NY. Bea, R. G. and Moore, W. (1994): "Management of Human Error in Operations of Marine Systems," Marine Technology Society Journal, Vol. 28, No. 1. Bea, R. G., et al. (1994): "Quality Assurance in Design, Construction, and Operation of Marine Structures," Report of Specialist Panel V.2, Proceedings 12th International Ship & Offshore Structures Congress, St. Johns, Newfoundland, Canada. 29 Bea, R. G., Cornell, C. A., Vinnem, J. E., Geyer, J. F., Shoup, G. J., and Stahl, B. (1994): “Comparative Risk Assessment of Alternative TLP Systems: Structure and Foundation Aspects,” J. of Offshore Mechanics and Arctic Engineering, Vol. 115, American Society of Mechanical Engineers, New York. Bea, R. G., and Roberts, K. H. (1995): “Human and Organization Factors in Design, Construction and Operation of Offshore Platforms,” Proceedings Society of Petroleum Engineers, SPE 30899, Richardson, TX. Bea, R. G., Holdsworth, R. D., and Smith, C. (Eds.) (1996): International Workshop on Human Factors in Offshore Operations, American Bureau of Shipping, New York, NY. Bea, R. G., Roberts, K. H., Mannarelli, T., Stoutenberg, S., and Jacobson, P. (1996): “High Reliability Tanker Loading & Discharge Operations: Ship Chevron Long Wharf, Richmond, California,” Proceedings of the Symposium on Human and Organizational Error in Marine Structures, Structure Committee and Society of Naval Architects and Marine Engineers, Arlington, VA. Bea, R. G., Schulte-Strathaus, R., and Dry, M. (1996): “Ship Quality Information Systems”, Proceedings of Safe and Efficient Ships - New Approaches for Design, Operation and Maintenance, The Institute of Marine Engineers, London. Bea, R. G. and Roberts, K. H. (1997): “Managing Rapidly Developing Crises: Real-Time Prevention of Marine System Accidents,” Proceedings 16th International Conference on Offshore Mechanics and Arctic Engineering, Safety & Reliability Symposium, ASME, New York, NY. Bea, R. G., and Hee, D. (1997): “A Safety Management Assessment System: SMAS,” Proceedings of the First Annual Conference of the Center for Risk Mitigation, University of California, Institute of Industrial Relations, Berkeley, CA. Bea, R. G., and Xu, T. (1997): “In-Service Inspection Programs for Marine Structures,” Proceedings 16th International Conference on Offshore Mechanics and Arctic Engineering, Materials Symposium, American Society of Mechanical Engineers, New York. Bea, R. G., et al. (1997): “Quality Assurance for Marine Structures,” Report of Specialist Panel V.1, Proceedings 13th International Ship & Offshore Structures Congress, Trondheim, Norway. Bea, R. G. and Lawson, R. B. (1997): Comparative Evaluation of Minimum Structures and Jackets, Stage II: Analysis of Human and Organizational Factors, Report to Joint Industry – Government Sponsored Project, Marine Technology and Management Group, University of California at Berkeley. Bea, R. G., Brandtzaeg, A., and Craig, M. J. K. (1998): “Life-Cycle Reliability Characteristics of Minimum Structures,” J. Offshore Mechanics and Arctic Engineering, Vol. 120, American Society of Mechanical Engineers, New York. Bea, R. G., and Mortazvai, M. (1998): “Reliability-Based Screening of Offshore Platforms,” J. Offshore Mechanics and Arctic Engineering, Vol. 120, American Society of Mechanical Engineers, New York. 30 Bea, R. G., and Reeve, H. (1998): Ship Structural Integrity Information System (SSIIS) Phase III: Ship Quality Information System, Ship Structure Committee Report SSC-404, Washington, DC. Bea, R. G., and Xu, T. (1998): Risk Based Hurricane Criteria for Design of Floating and Subsea Systems in the Bay of Campeche, Report to Petroleos Mexicanos, Instituto Mexicano del Petroleo, and Brown & Root International, Inc., Marine Technology & Management Group, University of California at Berkeley. Bea, R. G., Lara, L., Heredia, E., Valle, O., and Valdes, V. (1999): “Reliability Criteria for Design and Requalification of Pipelines and Risers in the Bay of Campeche, Mexico,” Proceedings 18th International Conference on Offshore Mechanics and Arctic Engineering, Safety and Reliability Symposium, American Society of Mechanical Engineers, New York. Beer, M., Eisenhart, R. A., Spector, B. (1990): “The Critical Path to Corporate Renewal,” Harvard Business School Review, Boston. Bekkevold, E., Fagerjord, O., Berge, M., and Funnemark, E. (1990): "Offshore Accidents, Do We Ever Learn? A 20 years report from VERITEC's World Wide Offshore Accident Databank (WOAD)", Proc. Offshore Safety Conference, Brazil. Bell, B. J., and Swain, A. D. (1981): A Procedure for Conducting a Human Reliability Analysis for Nuclear Power Plants, Report by Sandia National Laboratories to Office of Nuclear Regulatory Research, U. S. Nuclear Regulatory Commission, Wash. D. C. Bella, D. A. (1987): “Organizations and Systematic Distortion of Information,” J. of Professional Issues in Engineering, Vol. 113, No. 4, American Society of Civil Engineers, Herndon, VA. Bella, D. A. (1998): Technology and Environmental Systems, Civil Construction and Environmental Engineering Department Report, Oregon State University, Corvallis, OR. Bellamy, L. J. (1994): “Gaining a Better Understanding of Human Behavior in Emergencies,” Proceedings of the Conference on Mastering the Human Factors in Shipping, IIR Ltd., London. Bellamy, L. J., and Geyer, T. A. W. (1992): Organizational, Management and Human Factors in Quantified Risk Assessment, Report 1, Health and Safety Executive Research Report No. 33/1992, London, UK. Bellamy, L. J., Geyer, t. A., Wright, M. S., and Hurst, N. W. (1990): “The Development in the U. K. of Techniques to Take Account of Management, Organizational and Human Factors in the Modification of Risk Estimates,” Proceedings of the 1990 Spring National Meeting, American Institute of Chemical Engineers, New York. Bellamy, L. J., Kirwan, B., and Cox, R. A. (1986): “Incorporating Human Reliability into Probabilistic Safety Assessment,” Proceedings 5th International Symposium on Loss Prevention and Safety Promotion in the Process Industries, Cannes France, Societe de Chimie Industrille, Paris. Billinton, R., and Allan, R. N. (1983): Reliability Evaluation of Engineering Systems: Concepts and Techniques, Pitman Advanced Publishing Program, London. Biondi, E. L. (1998): Organizational Factors in the Reliability Assessment of Offshore Systems, Masters Thesis, College of Engineering, Oregon State University, Corvalis, OR. 31 Blockley, D. I. (1977): Analysis of Structural Failures, Institution of Civil Engineers, Part 1, London, England, Vol. 62. Blockley, D. I. (1981): "Reliability Theory - Incorporating Gross Errors." Third International Conference on Structural Safety and Reliability. Blockley, D. I. (1992): Engineering Safety, McGraw-Hill, London. Boeing Center for Leadership & Learning (1996): Applying CRM Methods and Best Practices in Developing High Performance Management Teams, Seminar Proceedings, Renton, Washington. Bogner, M. S. (Ed.) (1994): Human Error in Medicine, Lawrence Erlabaum Associates, Hillsdale, NJ. Boland, R. J., Jr. (1984): “Sense-making of Accounting Data as a Technique of Organizational Diagnosis,” Management Science, Vol. 30, New York. Boney, J. (1995): Deployment of Resources During Crisis Management, London Fire Brigade, London, UK. Boniface, D. (1996): An Analytical Methodology to Assess the Risks of and Countermeasures for Human and Organizational Error in the Marine Industry, Thesis, Department of Naval Architecture & Offshore Engineering, The University of California at Berkeley. Boniface, D., and Bea, R. G. (1996a): “Assessing the Risks of and Countermeasures for Human and Organizational Error,” SNAME Annual Meeting Proceedings, Society of Naval Architecture and Marine Engineers, Jersey City, NJ. Boniface, D., and Bea, R. G. (1996b): “A Decision Analysis Framework for Assessing Human and Organizational Error in the Marine Industries,” Proceedings SSC / SNAME Symposium, Human and Organizational Error in Marine Structures, Society of Naval Architects and Marine Engineers, Arlington, VA. Boniface, D., and Bea, R. G. (1996c): “Assessing the Risks of and Countermeasures for Human and Organizational Error,” Transactions of the Society of Naval Architects and Marine Engineers, Jersey City, NY. Bouton, I.(1974): "Application of the Error Disclosure Philosophy to the Fatigue Design of Structures," Proceedings of the Conference on Structural Safety and Reliability, American Society of Civil Engineers, Herndon, VA. British Standards Institution (1990): Quality Systems – Parts I to III, BS 5750, London, England. Brown C. B., and X. Yin (1988): "Errors in Structural Engineering," J. Structural Engineering, Vol. 114, No. 11, American Society of Civil Engineers, Herndon, VA. Brown, O., Jr., and Hendrick, H. W. (1996): “Human factors in organizational design and management,”, Proceedings of the Fifth International Symposium on Human Factors in Organizational Design and Management, North-Holland Publishers, Amsterdam, The Netherlands. Bruggink, G. M. (1978): “Assessing the Role of Human Performance in Aircraft Accidents,” Proceedings of the ISASI Forum, Winter, New York, NY. 32 Bruggink, G. M. (1985): “Uncovering the Policy Factor in Accidents,” Air Line Pilot, May, New York, NY. Bruner, J. S. (1973): Beyond the Information Given, Norton Publishers, New York. Calhoun, M. B. (1993): “Quality Improvement and Quality Management: Complementary or Contradictory?”, J. of Petroleum Technology, Sept., Society of Petroleum Engineers, Richardson, TX. Carr, P., Clayton, M., Busby, P. L., and Dobson, J. (1986): “A Probabilistic Strategy for Subsea Inspection of Steel Structures,” Proceedings of the Society of Petroleum Engineers European Petroleum Conference, SPE No. 15868, London. Carr, R. I. (1977): "Paying the Price for Construction Risk," Jl. Construction Div., American Society of Civil Engineers, Vol. 103, March, Herndon, VA. Center for Chemical Process Safety (1989): Guidelines for Technical Management of Chemical Process Safety, American Institute of Chemical Engineers, New York. Center for Chemical Process Safety (1992): Guidelines for Investigating Chemical Process Incidents, American Institute of Chemical Engineers, New York. Center for Chemical Process Safety (1993): Guidelines for Auditing Process Safety Management Systems, American Institute of Chemical Engineers, New York. Center for Chemical Process Safety (1994): Guidelines for Preventing Human Error in Process Safety, American Institute of Chemical Engineers, New York. Ciavarelli, A. P. (1996): “Aviation Safety Psychology,” Aviation Safety Programs, Naval Postgraduate School, Monterey, CA. Committee on Assuring the Safety of Innovative Marine Structures (1991): Assuring the Safety of Innovative Marine Structures, Marine Board, National Academy of Engineering, National Academy Press, Washington, DC. Committee on Science and Technology (1983): Study of Structure Failures, Report to the General Accounting Office, Washington, DC. Connell, L. J. (1996): “Aviation Safety Reporting System (ASRS),” Paper Presented to the Committee on Human Performance, Organizational Systems and Maritime Safety, National Research Council, Marine Board, Washington, DC. Cook, R. I., and Woods, D. D.(1994): “Operating at the Sharp End: The Complexity of Human Error,” Human Error in Medicine, M. S. Bogner (Ed.), Lawrence Erlbaum Associates, Hillsdale, NJ. Coren, S. (1996): Sleep Thieves, Simon & Schuster, London, UK. Cox, R. F. and Walter, M. H. (Eds) (1991): "Offshore Safety and Reliability", Proc. of the Safety and Reliability Society Symposium, Elsevier Applied Science, London. Crevani, G. (1986): "Outline of the Quality Assurance in the Offshore Field," Proceedings Italian National Association for Quality Assurance Seminar, Milan, Italy. 33 Cullen, S. and Bea, R. G. (1997): Development of a Human and Organizational Factors (HOF) Annex for Underwater Welding, Marine Technology and Management Group, University of California, Berkeley, CA. Das, P. K., and Garside, J. F. (1991): Structural Redundancy for Discrete and Continuous Systems, Report to Ship Structure Committee, SSC 354, Washington, DC. Davenport, T. H. (1993): Process Innovation: Reengineering Work Through Information Technology, Harvard Business School Press, Cambridge, MA. Demming, W. E. (1982): Out of the Crisis, Massachusetts Institute of Technology Center for Advanced Engineering Study, Cambridge, MA. Demsetz, L. A., Cario, R., and Schulte-Strathaus, R. (1996a): Inspection of Marine Structures, Report to Ship Structure Committee, SSC-389, Washington, DC. Demsetz, L. A., Cario, R., Huang, R. T., and Schulte-Strathaus, R. (1996b): “Factors Affecting Marine Structural Inspection Performance,” Human and Organizational Error in Marine Structures, Ship Structure Symposium ’96, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Denzin, N., and Lincoln, Y. S. (Eds.) (1994): Handbook of Qualitative Research, Sage Publishers, Thousand Oaks, CA. Det Norske Veritas Technica (1992): Offshore Reliability Data, OREDA-1992; Hovik, Norway. Det Norske Veritas Technica (1995): The Worldwide Offshore Accident Data Bank – WOAD, Hovik, Norway. Ditlevsen, O., and Hasofer, A. M. (1984): "Design Decision Model Considering MistakeProneness," Risk, Structural Engineering and Human Errors, Proceedings of a Symposium on Structural Technology and Risk, Grigoriu, M. U., (Ed.) University of Waterloo. Dorner, D. (1996): The Logic of Failure, Why Things Go Wrong and What We Can Do to Make Them Right, Metropolitan Books, Henry Holt and Co., New York. Dougherty, E. M. (1995): “Violation - Does HRA need the Concept?” Reliability Engineering and System Safety, Vol. 47, Elsevier Science Limited, London. Dougherty, E. M., Jr., and Fragola, J. R. (1986): Human Reliability Analysis, John Wiley & Sons, New York. Dougherty, E.M., and Collins, E. P. (1996): “Assessing the Reliability of Skilled Performance,” Reliability Engineering and System Safety, Vol. 51, Elsevier Science Limited, London. Drdacky, M. (Editor) (1992): "Lessons From Structural Failures," Proceedings of the Second International Conference, American Society of Civil Engineers, Sept. Druckman, D., and Bjork, R. A. (Eds.) (1994): Learning, Rembering, Believing, Enhancing Human Performance, Committee on Techniques for the Enahncement of Human Performance, Commissioin on Behavioral and Social Siences and Education, National Research Council, National Academy Press, Washington, DC. Drury, C. G., Lock, M. W. B. (1996): “Ergonomics in Civil Aircraft Inspection,” Human Error in Aircraft Inspection and Maintenance, Paper Presented to Marine Board Committee on Human 34 Performance, Organizational Systems, and Maritime Safety, National Academy of Engineering, National Research Council, Washington, D. C. Dry, M., Schulte-Strathaus, R., and Bea, R. G. (1995): Ship Structural Integrity Information System – SSIIS, Phase II, Ship Structure Committee Report, Washington, DC. Dunphy, D. (1996): “Organizational Change in Corporate Settings,” J. Human Relations, Vol. 49, No. 5. Dutton, J. E., and Dukerich, J. M. (1991): “Keeping an Eye on the Mirror: Image and Identiy in Organizational Adaptation, Academy of Management Journal, Vol. 34, New York. Dynamic Research Corporation (1989): The Role of Human Factors in Marine Casualties (Final Report), Prepared for U. S. Coast Guard. Contract no.: N00024-D-4373, June. Edmondson, J. N. (1993): "Human Reliability Estimates Within Offshore Safety Cases," Proc. of Symposium on Human Factors in Offshore Safety Cases, Aberdeen, Scotland, Nov. Eldukair, Z. A., and Ayyub, B. M. (1991): "Analysis of Recent U. S. Structural and Construction Failures," J. of Performance of Constructed Facilities, American Society of Civil Engineers, Vol. 5, No. 1, Feb. Ellinas, C. P. (1984): "Ultimate Strength of Damaged Tubular Bracing Members." J. of Structural Engineering, Vol. 110, No. 2, February. Ellingood, B. (1987): "Design and Construction Error Effects on Structural Reliability," J. of Structural Engineering, Vol. 113, No. 2, ASCE, 445-489. Embrey, D. (1991): "Managing Human Error in the Offshore Oil and Gas Industries", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland. Embrey, D. E. (1992): “Quantitative and Qualitative Prediction of Human Error in Safety Assessments,” Major Hazards Onshore and Offshore, Institution of Chemical Engineers, Rugby, UK. Embrey, D. E., Humphreys, P. C. Rosa, E. A., Kirwan, B., and Rea, K. (1984): SIM-MAUD: An Approach to Assessing Human Error Probabilities Using Structured Expert Judgment, NUREG/CR-3518, Vol. 1, Vol. 2, U. S. Nuclear Regulatory Commission, Washington, DC. Engelund, S. and Rackwitz, R. (1994): “Quality Assurance in Structural Design,” Structural Safety & Reliability, M. Shinozuka and J. Yao (Eds.), Balkema, Rotterdam, The Netherlands. Faber, M. H. (1997): “Risk Based Structural Maintenance Planning,” Probabilistic Methods for Structural Design, C. G. Soares (Ed.), Kluwer Academic Publishers, Amsterdam, The Netherlands. Farkas, B., and Bea, R. G. (1998): Pipeline Inspection, Maintenance & Performance Information System, Report to Joint Industry Project, Marine Technology & Management Group, University of California at Berkeley. Farkas, B., and Bea, R. G. (1999): PIMPIS: Pipeline Inspection, Maintenance, Performance Information System for Managing Corrosion Risk Associated with Offshore Pipelines, Report to Joint Industry – Government Project, Marine Technology & Management Group, University of California at Berkeley. 35 Feld, J. (1968): Construction Failures, John Wiley and Sons, New York, NY. Feltovich, P. J., Spiro, R. J., and Coulson, R. (1993): “Learning, Teaching and Testing for Complex Conceptual Understanding,” Test Theory for a New Generation of Tests, N. Fredericksen, R. Mislevy, and I. Bejar (Eds.), Lawrence Erlbaum Associates, Hillsdale, New Jersey. Ferguson, E. S. (1993): "How Engineers Lose Touch," Invention and Technology, Winter. Ferry, T. S. (1988): Modern Accident Investigation and Analysis, John Wiley Publishers, New York. Fischhoff, B. (1975): “Hindsight Does Not Equal Foresight: The Effect of Outcome Knowledge on Judgment Under Uncertainty,” J. of Experimental Psychology, Human Perception, and Performance, Vol. 1, pp. 288-299. Fitts, P. M. and Jones, R. E. (1961): “Analysis of Factors Contributing to 460 Pilot-Error Experiences in Operating Aircraft Controls,” Selected Papers on Human Factors in the Design and Use of Control Systems, H. W. Sinaiko (Ed,), Dover Publications, New York. Fitzgerald, B. P., Grant, M. M., and Green, M. D. (1991): "A Practical Methodology for Risk Assessment of Offshore Installations", Proc. Offshore Operations Post Piper Alpha Conference, London. Flanagan, R., and Norman, G. (1993): Risk Management and Construction, Blackwell Scientific Publications, London. Fleishman, E. A., Buffardi, L. C., Allen, J. A., and Gaskins, R. C. (1990): Basic Considerations in Predicting Error Probabilities in Human Task Performance, Report nby George Mason University to U. S. Nuclear Regulatory Commission, NUREG/CR-5438, Washington, DC. Flin, R. H., and Slaven, G. (1994): The Selection and Training of Offshore Installation Managers For Crisis Management, Health and Safety Executive, Offshore Technology Report OTH 92374, HSE Books, London. Flin, R. H., and Slaven, G. M. (1995): “Identifying the Right Stuff: Selecting and Training OnScene Emergency Commanders,” J. of Contingencies and Crisis Management, Blackwell Publishers Ltd., Oxford, UK. Flint, A. R., and Quinion, D. W. (1978): "Hazards at the Interface Between Design and Construction," Proceedings, Part 1, Inst. of Civil Engineers, Vol. 64, London. Follett, M. P. (1924): Creative Experience, Longmans, Green Publishers, New York. Fox, S. (1982): "Predicting the Proneness of Buildings to Gross Errors in Design and Construction," Master of Science Thesis, Univ. of Waterloo, Canada. Fraczek, J.(1979): "American Concrete Institute Survey of Concrete Structure Errors," Concrete International, Vol. 1, No. 12, ACI, New York, NY. Frangopol, D. M. (1986): "Combining Human Errors in Structural Risk Analysis," Civil Engineering Systems, Vol. 3, American Society of Civil Engineering, Herndon, VA. 36 Frangopol, D. M.(1989): "Considering Errors an Damage in Structural Reliability Assessment," Proc. Second Int. Symposium on Probability Methods Applied to Power Systems, Electric Power Research Institute, EL-6555, Nov. Fujimoto, Y., et al. (1991): “Inspection Planning for Deteriorating Structures Based on Sequential Cost Minimization Method,” Proceedings of the 11th Offshore Mechanics and Arctic Engineering Conference, American Society of Mechanical Engineers, New York, NY. Gale W. E., Jr., Bea, R. G., Moore, W. H., and Williamson, R. B. (1994): “A Methodology for Assessing and Managing Fire and Life Safety for Offshore Production Platforms,” Proceedings 1994 High Consequence Operations Safety Symposium, Sandia National Laboratories, Albuquerque, New Mexico. Gale, W. E., Jr., Bea, R. G., and Williamson, R. B. (1994): FLAIM, Fire and Life Safety Assessment and Indexing Methodology, Final Report to U. S. Dept. of Interior Minerals Management Service, Technology Assessment and Research Branch, Dept. of Civil Engineering, University of California at Berkeley. Gary, L. (2003): "Tested by Fire: What High-Reliability Organizations Know," Harvard Management Update, Article reprint No. U0312A, Harvard Business School Publishing newsletters: http://newsletters.harvardbusinessonline.org. Gates, E. T. (1989): Maritime Accidents: What Went Wrong ?, Gulf Publishing Co., Houston, TX. General Accounting Office (1990): Nuclear Safety: Concerns About Reactor Restart and Implications for DOE’s Safety Culture, GAO-RCED-90-104, Washington, DC. Gertman, D. I., and Blackman, H. S. (1994): Human Reliability and Safety Analysis Data Handbook, John Wiley & Sons, Inc., Chichester, UK. Gertman, D. I., Gilmore, W. E., Groh, M., Galyean, W. J., Gentillon, C., and Gilbert, B. G. (1988): Nuclear Computerized Library for Assessing Reactor Reliability (NUCLARR), Vol. 1 , EGG2458, NUREG/CR-4639, USNRC, Washington, DC. Geyer, T. A., Bellamy, L. J., Astley, J. A., and Hurst, N. W. (1990): “Prevent Pipe Failures Due to Human Errors,” Chemical Engineering Progress, November. Godfrey, D., Curole, M., and Miller, G. (1996): “Six years of experience incorporating human factors engineering into offshore facilities design,” 1996 International Workshop on Human Factors in Offshore Operations, R. G. Bea, R. D. Holdsworth, C. Smith (Eds.), American Bureau of Shipping, Houston, TX. Godfrey, K. A., Jr. (1984): "Building Failures: Construction Related Problems and Solutions," Civil Engineering, American Society of Civil Engineers, Vol. 54, No. 5. Gonzales, Q. M., and Okrent, D. (1985): "Methods for Evaluation of Risk Due to Seismic Related Design and Construction Errors Based on Past Reactor Experience," Proceedings, American Nuclear Society Int. Meeting on Probabilistic Safety Methods and Applications, American Nuclear Society, San Francisco, CA. Gordon, R. P. E. (1998). “The Contribution of Human Factors to Accidents in the Offshore Oil Industry,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. 37 Gould, S. J. (1981): The Mismeasure of Man, Norton Publishers, New York. Groeneweg, J. (1994): Controlling the Controllable, DSWO Press, Leiden University, The Netherlands. Gudmestad, O. T. Rettedal, W. K., Sand, S., Brabazon, P., Trbojevic, V., and Helsoe, E. (1995): “Use of Simulator Training to Reduce Risk in Offshore Marine Operations,” Proceedings Offshore Mechanics and Arctic Engineering Conference, American Society of Mechanical Engineers, New York. Gudmestad, O. T., Gordon, R., et al (1996): “The Role of Human and Organizational Factors (HOF) in the Fabrication, Installation, and Modification (FIM) Phases of Offshore Facilities,” Proceedings International Workshop on Human Factors in Offshore Operations, R. G. Bea, R. D. Holdsworth, C. Smith (Eds.), American Bureau of Shipping, Houston, TX. Haber, S.B., O’Brien, J. N., Metlay, D. S., and Crouch, D. A. (1991): Influence of Organizational Factors on Performance Reliability: Overview and Detailed Methodological Development, U. S. Nuclear Regulatory Commission, NUREG/CR-5538, Washington, DC. Hadipriono, F. G. (1977): "Analysis of Events in Recent Structural Failures," J. of Structural Engineering, American Society of Civil Engineers, Vol. 111, No. 7. Hale, A. R. (1984): “Is Safety Training Worthwhile?,” J. of Occupational Accidents, Vol. 6, New York, NY. Hale, A., Wilpert, B., and Freitag, M. (1997): After The Event, From Accident to Organizational Learning, Pergamon Press, Elsevier Sciences Ltd., Oxford, UK. Hallas, O. (1991): "A Model for Human Error Prevention in Design- Experiences From an Offshore Project", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland. Hammer, M., and Champy, J. (1993): Reengineering the Corporation: a Manifesto for Business Revolution, Harper Collins Publishers, New York. Harris, D. and Chaney, F. (1969): Human Factors in Quality Assurance, John Wiley and Sons, New York, N. Y., 1969. Harris, D. H. (Ed.) (1994): Organizational Linkages – Understanding the Productivity Paradox, Panel on Organizational Linkages, Committee on Human Factors, Commission on Behavioral and Social Sciences and Education, National Research Council, National Academy Press, Washington, DC. Harrison, P. I. (1992): Organizational, Management and Human Factors in Quantified Risk Assessment, Report 2, Health and Safety Executive Contract Research Report No. 34/1992, London, UK. Hashemi, K. (1991): "An Integrated Approach to a Safety Case", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland, April. Haugen, E. B. (1968): Probabilistic Approaches to Design, John Wiley & Sons, New York. Hauser, R. (1979): "Lessons from European Failures." Concrete International, Vol. 1, No. 12, ACI, New York, NY, 1223-1334, Hawkins, F. H. (1987): Human Factors in Flight, Gower Technical Press, Amsterdam. 38 Heath & Safety Executive, Offshore Installations (Prevention of Fire and Explosion and Emergency Response) (PFEER) Regulations, London, 1996. Hee, D. D., and Bea, R. G. (1997): Safety Management Assessment System (SMAS), Marine Technology and Management Group, University of California, Berkeley. Hee, D. D., Bea, R. G., Roberts, K. H., and Williamson, B. (1998): “Safety Management Assessment System (SMAS) Part I: A Process for Identifying and Evaluating Human and Organization Factors in Operations of Offshore Platforms,” Proceedings of the Offshore Mechanics and Arctic Engineering Conference OMAE’98, Lisbon, Portugal, Society of Mechanical Engineers, New York, NY. Hee, D. D., Pickrell, B., Bea, R. G., Roberts, K. H., and Williamson, B. (1998): “Safety Management Assessment System (SMAS) Part II: Field Test and Results,” Proceedings of the Offshore Mechanics and Arctic Engineering Conference OMAE’98, Lisbon, Portugal, Society of Mechanical Engineers, New York, NY. Heimann, C. F. L. (1993): “Understanding the Challenger Disaster: Organizational Structure and the Design of Reliable Systems,” American Political Science Review, Vol 87, No. 2, June. Heising, C.D., and Grenzebach, W. S. (1991): "The Ocean Ranger Oil Rig Disaster: A Risk Analysis," Risk Analysis, Vol. 9, No. 1. Helmreich, R. L, and Schaefer, H-G. (1994): “Team Performance in the Operating Room,” Human Error in Medicine, M. S. Bogner (Ed.), Lawrence Erlbaum Associates, Hillsdale, NJ. Helmreich, R. L., and Foushee, H. C. (1993): “Why Crew Resource Management?: The History and Status of Human Factors Training Programs in Aviation,” Cockpit Resource Management, E. Wiener, B. Kanki, and R. Helmreich (Eds.), Academic Press, New York. Hendrick, H. W. (1991): “Ergonomics in Organizational Design and Management,” Ergonomics, Taylor & Francis Ltd., London, UK. Hendrick, H. W. (1996): “Human Factors in ODAM: An Historical Perspective,” Human Factors in Organizational Design and Management - V, O. Brown, Jr., and H. W. Hendrick (Eds.), North-Holland Publishers, Amsterdam, Netherlands. Hendrick, H. W., and Vercruyssen, M. (1989): Behavioral Research An Analysis: Introduction to Statistics Within the Context of Experimental Design, Ergosyst Associates Inc., Lawrence, KS. Hendrick, K. and Benner, L. Jr. (1987): Investigating Accidents with STEP, Marcel Dekker, New York. Henley, E. J. and H. Kumamoto (1981): Reliability Engineering and Risk Assessment, Englewood Cliffs, NJ. Prentice Hall Inc., Cambridge, U. K., Cambridge University Press. Hennegan, N., Abadie, W., Goldberg, L., and Winkworth, W (1996): "Inspections, Surveys and Data Management", Proceedings of International Workshop on Requalification of Existing Offshore Structures, U. S. Minerals Management Service, Herndon, VA. Henriksen, K., Kaye, R. D., Jones, r. E., Jr., Morisseau, D. S. and Persensky, J. J. (1993): An Examination of Human Factors in External Beam Radiation Therapy: Findings and Implications, Proceedings of the US Nuclear Regulatory Commission Twenty-First Water Reactor Safety Information Meeting, Vol. 1, Washington, DC. 39 Hokstad, P., Oien, K., and Reinertsen, R. (1998): “Recommendations on the Use of Expert Judgment in Safety and Reliability Engineering Studies: Two Offshore Case Studies,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Holdsworth, R. (1999): “Company Profit Incentives for Improved Risk Management,” Personal Communication, Galveston, Texas, February 5, Risk, Reliability, Safety Engineering, New Orleans, LA. Hollnagel, E. (1993): Human Reliability Analysis, Context, and Control, Academic Press Ltd., Lond, UK. Hope, B., and Johannessen, P. A. (1983): Safety Management in Offshore Development Projects, Tanum Publishers, Oslo, Norway. Hsu, T. M. (1990). “Residual Strength of Tubular Members With Holes.” Proceedings Structures Congress Technical Session on Maintenance and Qualification of Offshore Platforms, American Society of Civil Engineers, Herndon, VA. Huber, G. P. and Glick, W. H. (Eds): Organizational Change and Redesign, Oxford Publishers, New York. Hudson, P. T. W., Reason, J., Wagenaar, W., Bentley, P., Primrose, M., and Visser, J. (1994): “Tripod Delta: Proactive Approach to Enhanced Safety,” Journal of Petroleum Technology, Vol. 46, Society of Petroleum Engineers, Richardson, TX. Hudson, P. T. W., Wagenaar, W. A., Reason, J. T., Groeneweg, J., van der Meeren, R. J. W., and Visser, J. P. (1996a): “Application of TRIPOD to Measure Latent Errors in North Sea Gas Platforms: Validity of Failure State Profiles,” Proceedings First International Conference on Health, Safety and Environment, SPE 23293, Society of Petroleum Engineers, Richardson, TX. Hudson, P. T. W., Wagenaar, W. A., Reason, J. T., Groeneweg, J., van der Meeren, R. J. W., and Visser, J. P.(1996b): “Enhancing Safety in Drilling: Implementing TRIPOD in a Desert Drilling Operation,” Proceedings First International Conference on Health, Safety and Environment, SPE 23248, Society of Petroleum Engineers, Richardson, TX. Huey, B. M. and Wickens, C. D. (Editors) (1993): Workload Transition - Implications for Individual and Team Performance, Panel on Workload Transition, Committee on Human Factors, National Research Council, Commission on Behavioral and Social Sciences and Education, National Academy Press, Washington, D. C. Humphreys, P. (Ed) (1988): Human Reliability Assessors Guide, United Kingdom Atomic Energy Authority, RTS 88/95Q, Culcheth Warrington, UK. Hurst, N. W., Bellamy, L. J., and Geyer, T. A. W. (1990): Organisational, Management and Human Factors in Quantified Risk Assessment: A Theoretical and Empirical Basis for Modification of Risk Estmates,” Proceedings Safety and Reliability Symposium, SARSS ’90, Manchester, UK. Hurst, N. W., Bellamy, L. J., and Wright, M. S. (1992): “Research Models of Safety Management of Onshore Major Hazards and Their Possible Application to Offshore Safety,” Major Hazards Onshore and Offshore, Institution of Chemical Engineers, Symposium Series NO. 13, EFCE Pub. No. 93, Warwickschire, UK. Hurst, N. W., Bellamy, L. J., Geyer, T. A., and Astley, J. A. (1991): “A Classification Scheme 40 for Pipework Failures to Include Human and Socio-Technical Errors and Their Contribution to Pipework Failure Frequencies,” J. Hazardous Materials, Vol. 26, London, UK. Hurst, N. W., Nussey, C., and Pape, R. P. (1989): “Development and Application of a Risk Assessment Took (RISKAT) in the Health & Safety Executive,” Chemical Engineering Research Design, Vol. 67, London, UK. Hutchings, C. (1996): “CRM: Applying the Skills,” Applying CRM Methods and Best Practices in Developing High Performance Management Teams, Boeing Center for Leadership & Learning, Renton, WA. Ingles, O. G. (1985): Human Error, and its Role in the Philosophy of Engineering, Doctoral Thesis, University of New South Wales, Australia. Ingstad, O. (1991): "Approaching Better Human Factors Design of Offshore Control Rooms," Proceedings Human Factors in Offshore Safety Conference, Aberdeen, Scotland, April, 1991. International Labor Organization (1996): Ergonomic Checkpoints, International Labor Office, Geneva. International Maritime Organization (1993): International Management Code for the Safe Operation of Ships and for Pollution Prevention ,International Safety Management (ISM) Code, Resolution A.741 (18), London, UK. International Standards Organization (1994a): ISO 9000 Series, Quality Management and Quality Assurance Standards, British Standards Inst. Publication, London, UK. International Standards Organization (1994b): Quality Systems - Model for Quality Assurance in Design / Development, Production, Installation, and Servicing, ISO 9001, London, UK. International Standards Organization (1995): Health, Safety, and Environmental Management Systems, Technical Committee ISO/TC 67, Materials, Equipment and Offshore Structures for Petroleum and Natural Gas Industries, Sub-Committee SC 6, Processing Equipment and Systems, London, UK. International Standards Organization (1998): Ergonomics Principles in the Design of Work Systems, ISO 6385, London, UK. Isenberg. D. J. (1986): “The Structure and Process of Understanding: Implications for Managerial Action,” The Thinking Organization, H. P. Sims, Jr., and D. A. Gioia (Eds.), JosseyBass Publishers, San Francisco, CA. Itagaki, H., Akita, Y. and Nitta, A. (1983): "Application of Subjective Reliability Analysis to the Evaluation of Inspection Procedures on Ship Structures", Proceedings of the International Symposium on the Role of Design, Inspection and Redundancy on Marine Structural Reliability, National Academy Press, Washington, DC. Jakobsen, B. (1992): "The Loss of Sleipner A Platform", Proceedings of the Second International Offshore and Polar Engineering Conference, International Society of Offshore and Polar Engineers, Golden CO. James, W. (1950): The Principles of Psychology, Vols. 1 and 2, Dover Publishers, New York. Janis, I. (1972): Victims of Groupthink, Houghton Mifflin Publishers, Boston, MA. 41 Johnson, W. G. (1980): MORT Safety Assurance Systems, National Safety Council and Marcel Decker, New York. Jones, E. D., Banks, W. W., Altenbach, T. J., and Fisher, L. E. (1995): Relative Risk Analysis in Regulating the Use of Radiation-Emitting Medical Devices – A Preliminary Application,” NUREG/CR-6323, UCRL-ID-120051, U. S. Nuclear Regulatory Commission, Washington, DC. Jones, R. B. (1995): Risk-Based Management - A Reliability-Centered Approach, Gulf Publishing Co., Houston, TX. Kaarstad, O. and Wulff, E. (1984): Safety Offshore, Global Book Resources Ltd., London and Columbia University Press, New York, NY. Kahn, R. L, (1974): “Organizational Development: Some Problems and Proposals,” J. Applied Behavioral Science, Vol 10. Kahneman, D. and Tversky, A. (1979): “Prospect Theory: An Analysis of Decision Under Risk,” Econometrics, Vol. 47, pp. 263-291. Kahneman, D., Slovic P., and Tversky, A. (1982): Judgment Under Uncertainty: Heuristics and Biases, New York: Cambridge University Press. Kaminetsky, P. (1991): Design and Construction Failures, McGraw Hill, Inc., New York, N. Y. Kantowitz, H. H. and Sorking, R. D. (1983): Human Factors: Understanding People-System Relationships, John Wiley and Sons, New York, NY. Katz, D., and Kahn, R. L. (1966): The Social Psychology of Organizations, John Wiley Publishers, New York. Kayten, P. J. (1993): “The Accident Investigator’s Perspective,” Academic Press, New York, NY. Kerr, S. (1975): “On the Folly of Rewarding A While Hoping for B., Academy of Management Journal, Vol. 18, New York, NY. Kirwan, B. (1994): A Guide to Practical Human Reliability Assessment, Taylor & Francis Ltd., London, UK. Kirwan, B. (1997): “Evolving Human Factors in Offshore Operations,” 1996 International Symposium on Human and Organizational Factors in Operations of Offshore Platforms, R. G. Bea, R. D. Holdsworth, C. Smith (Eds), American Bureau of Shipping, Houston, TX. Klein, G. (1999): Sources of Power, The MIT Press, Cambridge, MA. Kletz, T. (1991): An Engineer’s View of Human Error, Institution of Chemical Engineers, Rugby, U. K. Knoll, F. (1986): "Checking Techniques," Modeling Human Error in Structural Design and Construction, A. S. Nowak (Ed.), American Society of Civil Engineers, Herndon, VA. Kolodner, J. (1993): Case-Based Reasoning, Morgan Kaufmann Publishers, San Mateo, CA. Kolodner, J. , and David, B. (1996): “A Tutorial Introduction to Case-Based Reasoning,” CaseBased Reasoning – Experiences, Lessons, and Future Directions, D. B. Leake (Ed.), American Association for Artificial Intelligence Press, the MIT Press, Cambridge, MA. 42 Kontogiannis, T., and Lucas, D. (1990): Operator Performance Under High Stress: An Evaluation of Cognitive Modes, Case Studies and Countermeasures, Report No. R90/03, Nuclear Power Engineering Test Center, Tokyo, Japan, Human Reliability Associates, Dalton, Wigan, Lancashire, U. K. Kosmowski, K. T. and Duzinkiewicz, K. (1993): "An Integrated Approach in Probabilistic Modeling of Hazardous Technological Systems with Emphasis on Human Factor," Proceedings of International Conference on Structural Safety and Reliability, San Francisco, CA. Kotter, J. P. (1996): Leading Change, Harvard Business School, Boston, MA. Krawinkler, H. (1994): The Northridge Question: Can We Do Better?," Civil Engineering, May, ASCE, Herndon, VA. Kupfer, H. and Rackwitz, R. (1980): "Models for Human Error and Control in Structural Reliability," Proceedings of the International Association of Bridge and Structural Engineers, Vienna, Austria. Lagadec, P. (1993): Preventing Chaos in a Crisis - Strategies for Prevention, Control and Damage Limitation, McGraw-Hill Book Co., London. Lakats, L. M., Gudmestad, O. T., Skjaeveland, H. Rettedal, W. K., and Gausel, E. (1997): “Managing Offshore Platform Construction Taking into Account Bad News – A Case Study,” Submitted for Publication in Risk Analysis. Lancaster, J. (1996): Engineering Catastrophes, Causes and Effects of Major Accidents, Abington Publishing, Cambridge, UK. Lauber, J. K. (1989): “Human Performance and Aviation Safety: Some Issues and Some Solutions,” Paper Presented to the Aero Club of Washington, National Transportation Safety Board, Washington, DC. Lawson, R. B., and Bea, R. G. (1997): Risk Mitigation in Socio-Technical Systems Through Systematic Analysis of Human and Organizational Factors, Marine Technology and Management Group, University of California, Berkeley, CA. Lawson, R. B., and Bea, R. G. (1997): SYRAS System Risk Assessment Software, Version 1.0, Report to Joint Industry Project Comparative Evaluation of Minimum Structures and Jacket, Marine Technology & Management Group, University of California at Berkeley. Lenz, M., Bartsch-Sporl, Burkanard, H-D., and Wess, S. (Eds.) (1998): Case-Based Reasoning Technology – Lecture Notes in Artificial Intelligence, Springer, London, UK Leplat, J. (1982): “Accidents and Incidents in Production: Methods of Analysis,” J. of Occupational Accidents, Vol. 4, New York. Leplat, J. and Rasmussen, J. (1984): “Analysis of Human Errors in Industrial Incidents and Accidents for Improvements of Work Safety,” Accident Analysis and Prevention, Vol. 16, New York. Lewin, K. (1951): Field Theory in Social Science, Harper & Row Publishers, New York. Liberatore, T. C. and Bea, R. G. (1998): Risk Analysis and Management of Diving Operations: Assessing Human Factors, Ocean Engineering Graduate Program, College of Engineering, University of California at Berkeley. 43 Libuser, C. (1994): Managing Organizations to Achieve Risk Mitigation, Dissertation, Andersen School of Business, University of California, Los Angeles. Libuser, C., and Rousseau, D. M., 1995, “Contingent Workers in High Risk Environments,” Symposium on Averting Catastrophe and Managing Risk in Complex Organizations and Systems, Academy of Management, Vancouver, British Columbia. Lighthall, F. F. (1991): “Launching the Space Shuttle Challenger: Disciplinary Deficiencies in the Analysis of Engineering Data,” IEEE Transactions on Engineering Management, Vol. 38, No. 1. Lind, N. C. (1980): "Models of Human Errors in the Structural Reliability," Proceedings Annual Convention, Portland Oregon, American Society of Civil Engineers, Herndon, VA. Lind. N. C. (1983): "Models of Human Error in Structural Reliability," Structural Safety, Vol. 1. Loch, K. J., and Bea, R. G. (1995): Determination of the Ultimate Limit States of Fixed SteelFrame Offshore Platforms Using Static Pushover Analyses, Report to U. S. Minerals Management Service and Joint Industry Project Sponsors, Marine Technology & Development Group, University of California at Berkeley. Loh, J. T. (1993): “Ultimate Strength of Dented Tubular Steel Members.” Proceedings3rd International Offshore and Polar Engineering Conference, Vol. 4, International Society of Offshore and Polar Engineers, Golden, CO. Loney, T. J., and Ramierz, C. (1994): Identifying Some of the Critical Activities Essential to Quality Improvement Processes, Report to the U. S. General Services Administration, Washington, D. C. Louis, M. (1980): “Surprise and Sensemaking: What newcomers Experience in Entering Unfamiliar Organizational Settings,” Administrative Science Quarterly, Vol. 25, New York. Luckas, W. J., Wreathall, J., Cooper, S. E., Barriere, M. T., and Brown, W. S. (1993): “Development of a Methodology for Conducting an Integrated HRA/PRA - Task 1- An Assessment of Human Reliability Influences During LP&S Conditions in PWRs,” Proceedings of the U. S. Nuclear Regulatory Commission Twentieth Water Reactor Safety Information Meeting, BYREG/CP-0126, U. S. Nuclear Regulatory Commission, Washington, DC. Ma, K. T., and Bea, R. G. (1995): “A Repair Management System for Fatigue Cracks in Ships,” Transactions, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Ma, K. T., Orisamolu, I. R., Bea, R. G., and Huang, R. T. (1997): “Towards Optimal Inspection Strategies for Fatigue and Corrosion Damage,” Transactions Society of Naval Architects and Marine Engineers, Garden Park, NJ. Marshall, P. W., and Bea, R. G. (1976): “Failure Modes of Offshore Platforms,” Proceedings Behavior of Off-Shore Structures, BOSS ’76, Technical University of Norway, Trondheim, Norway. Madsen, H. O., Krenk, S., and Lind, N. C. (1986): Methods of Structural Safety, Prentice Hall, New York, NY. Madsen, H. O., Skjong, R., Tallin, A. G., and Kirkemo, F. (1987): "Probabilistic Fatigue Crack Growth Analysis of Offshore Structures, with Reliability Updating Through Inspection," 44 Proceeding of the Spring Symposium of Society of Naval Architects and Marine Engineers, New York, NY. Madsen, H. O. (1997): “Stochastic Modeling of Fatigue Crack Growth and Inspection,” Probabilistic Methods for Structural Design, C. G. Soares (Ed.), Kluwer Academic Publishers, The Netherlands. Maher, M. L., Balachandran, M. B., and Zhang, D. M. (1995): Case-Based Reasoning in Design, Lawrence Erlbaum Associates, Hove, UK. Mandler, G. (1984): Mind and Body: Psychology of Emotion and Stress, Norton Publishers, New York. Manganelli, R. L., and Klein, M. M. (1994): The Reengineering Handbook: A Step by Step Guide to Business Transformation, American Management Association, New York. Mannarell, T., Roberts, K. H., and Bea, R. G. (1996): “Learning How Organizations Mitigate Risk,” J/ of Contingencies and Crisis Management, Vol. 4, No. 2, Blackwell Publishers LTD., Oxford, UK. Marine Technology Directorate (1989): Underwater Inspection of Steel Offshore Installations: Implementation of a New Approach, Report 89/104, London. Marine Technology Directorate (1992): Probability-Based Fatigue Inspection Planning, Report 92/100, London. Marine Technology Directorate (1994): Review of Repairs to Offshore Structures and Pipelines, Report 94/102, London. Mason, E., Roberts, K., and Bea, R. G. (1994): Marine Human and Organizational Error: A Data Evaluation, Report to Sea Grant Program on Project RO/E 28, Sea Grant College Program, La Jolla, CA. Matousek, M. (1977): "Outcomings of a Survey on 800 Construction Failures.," Proceedings International Association of Bridge and Structural Engineers Colloquium on Inspection on Quality Control, Cambridge, England. Matousek, M. (1980): "A System of Strategies Against Human Errors as an Element of an Overall Safety Concept," Proceedings of the Intl. Ass. of Bridge and Structural Engineers 11th Congress, Cambridge, England. Matousek, M. (1990): "Quality Assurance," Engineering Safety, D. Blockley (Ed.), McGraw-Hill Book Co., London, 1990. Maurino, D. E., Reason, J., Johnston, N., and Lee, R. B. (1995): Beyond Aviation Human Factors: Safety in High Technology Systems, Avebury Aviation, Ashgate Publishing Ltd., Hants, England. McCormick, E. J. and Sanders, M. S. (1982): Human Factors in Engineering and Design, McGraw-Hill, New York, NY. McNamara, G., and Bromley, P. (1997): “Decision Making in an Organizational Setting: Cognitive and Organizational Influences on Risk Assessment in Commercial Lending,” Academy of Management Journal, Vol 40, Danvers, MA. 45 McSween, T. E. (1995): The Values-Based Safety Process, Improving Your Safety Culture with a Behavioral Approach, Van Nostrand Reinhold, International Thomson Publishing Inc., New York, NY. Meister, D. (1971): Human Factors: Theory and Practice, John Wiley-Interscience Publishers, New York. Meister, D. and Rabideau, G. F. (1965): Human Factors Evaluation in System Development, John Wiley and Sons, New York, NY. Melchers, R. E. (1980): “Societal Options for Assurance of Structural Performance,” Final Report, 11th Congress, International Association of Bridge and Structural Engineers Proceedings, London, UK. Melchers, R. E. (1987): "Human Errors, Human Intervention and Structural Safety Predictions," International Association of Bridge and Structural Engineers Proceedings, London, UK. Melchers, R. E. (1987): Structural Reliability Analysis and Prediction, Brisbane, Australia: Ellis Horwood Limited, Halsted Press: a Division of John Wiley & Sons. Melchers, R. E., and Harrington, M. V. (1983): "Structural Reliability as Affected by Human Error," Proceedings, Fourth Int. Conference. on Applications of Probability and Statistics in Soil and Structural Engineering, Florence, Italy. Melchers, R. E., Baker, M. J., and Moses, F. (1983): “Evaluation of Experience,” Proceedings IABASE Workshop on Quality Assurance Within the Building Process,” International Association of Bridge and Structure Engineers, Rigi, Switzerland. Merry, M. (1998): “Assessing the Safety Culture of an Organization,” J. Safety and Reliability Society, Vol. 18, No. 3, Manchester, UK. Meshkati, N. (1995): “Cultural Context of the Safety Culture: A Conceptual Model and Experimental Study,” Proceedings of the International Topical Meeting on Safety Culture in Nuclear Installations, U. S. Nuclear Regulatory Commission, Washington, DC. Miles, M. B., and Huberman, A. M. (1994): Qualitative Data Analysis, Sage Publications, London, UK. Mill, R. C. (1992): Human Factors in Process Operations, Institution of Chemical Engineers, Warwickshire, UK. Miller, C. O., 1979, “Human Factors in Accident Investigation,” Proceedings of the Symposium on Human Factors in Civil Aviation, Safety and Efficiency: The Next 50 years, Dutch Air Line Pilots Association Meeting, The Hague, The Netherlands. Miller, D. (1994): “What Happens After Success: The Perils of Excellence, J. Management Studies, Vol. 31. Miller, G. E. (1990): "The Omission of Human Engineering in the Design of Offshore Equipment and Facilities: How Come?," Proceedings Offshore Technology Conference, Paper OTC 6481, Society of Petroleum Engineers, Richardson, TX. Miller, J. G. (1978): Living Systems, McGraw-Hill Publishers, New York. 46 Mintzberg, H., and Westley, F. (1992): “Cycles of Organizational Change,” J. Strategic Management, Vol. 13. Moan, T.(1981): The Alexander Kielland Accident, Report of the Norwegian Government Commission, Oslo, Norway. Moan, T. (1993a): "Safety of Offshore Structures," Proceedings Fourth Int. Conference on Applications of Statistics and Probability in Soil and Structural Engineering. Moan, T. (1993b): “Reliability and Risk Analysis for Design and Operations Planning of Offshore Structures,” Proceedings of the 6th International Conference on Structural Safety and Reliability, ICOSSAR’93, Insbruck, Austraia. Moan, T. (1994): “Reliability and Risk Analysis for Design and Operations Planning of Offshore Structures,” Proceedings 6th ICOSSAR, Structural Safety and Reliability, Vol. 1, Balkema, Rotterdam. Moan, T. (1997): “Current Trends in the Safety of Offshore Structures,” Proceedings International Offshore and Polar Engineering Conference, International Society of Offshore and Polar Engineers, Golden, CO. Moore, W. H. (1993): Management of Human and Organizational Error in Operations of Marine Systems, Doctor of Engineering Dissertation, Department of Naval Architecture and Offshore Engineering, University of California, Berkeley. Moore, W. H. (1994): "The Grounding of Exxon Valdez: An Examination of the Human and Organizational Factors," Marine Technology, Vol. 31, No. 1, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Moore, W. H., and Bea, R. G. (1993a): "Human and Organizational Errors in Operations of Marine Systems: Occidental Piper Alpha & High Pressure Gas Systems on Offshore Platforms", Proceedings Offshore Technology Conference, Society of Petroleum Engineers, Richardson, TX. Moore, W. H., and Bea, R. G. (1993b): Management of Human Error in Operations of Marine Systems, Report No. HOE-93-1, Final Joint Industry Project Report, Dept. of Naval Architecture and Offshore Engineering, University of California, Berkeley, CA. Moore, W. H., and Bea, R. G. (1993c): "Human and Organizational Errors in Operations of Marine Systems: Occidental Piper Alpha & Exxon Valdez." Proceedings 12th International Conference on Offshore Mechanics & Arctic Engineering, American Society of Mechanical Engineers, Glasgow, Scotland. Moore, W. H., Bea, R. G., Roberts, K. H. (1993) . "Improving the Management of Human and Organization Errors (HOE) in Tankers Operations," Proceedings of Ship Structures Symposium '93, Ship Structure Committee and Society of Naval Architects and Marine Engineers, Jersey City, NJ. Moore, W. H. and McIntyre, S. R. (1994): "The Human Element in Marine Safety", Surveyor, American Bureau of Shipping, June. Moore, W. H. and Roberts, K. H. (1994): "New Developments in Safety Management for the Maritime Industry: The International Safety Management Code," Proceedings 1994 High Consequence Operations Safety Symposium, Sandia National Laboratories, Albuquerque, NM. 47 Moore, W. H., and Bea, R. G. (1995): “Management of Human and Organizational Error Throughout a Ship’s Life Cycle,” Proceedings of the International Conference on Marine Engineering Systems - Management and Operation of Ships: Practical Techniques for Today and Tomorrow, ICMES 95, Paper 18, The Institute of Marine Engineers, London, UK. Moore, W. H. and Miller, G. (1997): “Human Factor Engineering Applications to the Design of Offshore Platforms,” Proceedings of the Optimizing Offshore Safety Conference, IBC Asia, Ltd., Kuala Lumpur, Malaysia. Moore, W. H. and Miller, G. (1998): “Application of Ergonomics to the Design of Offshore Systems,” Proceedings of the Offshore Mechanics and Arctic Engineering Conference, Lisbon, Portugal, American Society of Mechanical Engineers, New York, NY. Morgenstern, J. (1997): “The Fifty-Nine-Story Crisis,” J. of Professional Issues in Engineering Education and Practice, Vol. 123, No. 1, American Society of Civil Engineers, Herndon, VA. Mortazavi, M., and Bea, R. G. (1995): Screening Methodologies for Use in Platform Assessments and Requalifications, Final Report to Joint Industry Sponsored Project, Marine Technology & Management Group, University of California at Berkeley. Mowday, R. T., and Sutton R., I. (1993): “Organizational Behavior: Linking Individuals and Groups to Organizational Contexts,” Annual Review of Psychology, Vol. 44, New York. Mowday, R., and Steers, R. M. (1979): “The Measurement of Organizational Commitment,” J. of Vocational Behavior, Vol. 14, New York, NY. Mumaw, R. J., Swatzler, D., Roth, E. M., and Thomas, W. A. (1994): Cognitive Skill Training for Decision Making, U. S. Nuclear Regulatory Commission, NUREG/CR-6126, Washington, DC. Murphy, D. M. and Pate-Cornell, E. (1996): “The SAM Framework: Modeling the Effects of Management Factors on Human Behavior in Risk Analysis,” Risk Analysis, Vol. 16, No. 4. Mylls, R. (1993): Information Engineering: Case Practices and Techniques, John Wiley & Sons, New York. Nagel, D. C.(1988): "Group Interaction and Flight Crew Performance," Human Factors in Aviation, Weiner & Nagel ed., Academic Press, New York, NY. Nagendran, R. (1994): Modeling the Assessment of Human Factors and Safety in the Marine Transportation System, MS Thesis, Department of Civil Engineering, Virginia Polytechnic Institute and State University, Blacksburg, VA. Nessim, M. A. (1983): Decision Making and Analysis of Errors, Ph. D. Dissertation, University of Calgary, Calgary, Alberta, Canada. Nessim, M. A., and Jordaan, I. J. (1985): "Models for Human Error Reliability," J. of Structural Eng., Vol. 111, No. 6, American Society of Civil Engineers, Herndon, VA. Nickerson, R. S. (Ed.) (1995): Emerging Needs and Opportunities for Human Factors Research, Committee on Human Factors, Commission on Behavioral and Social Sciences and Education, National Research Council, National Academy Press, Washington, D .C. Nilsen, T., Gudmestad, O. T., Dalane, J. I., Rettedal, W. K., and Aven, T. (1998): “Utilisation of Principles from Structural Reliability in Quantitative Risk Analysis: Example from an Offshore 48 Transport Problem,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Nisbett, R., and Ross, L. (1980): Human Inference: Strategies and Shortcomings of Social Judgment, Prentice-Hall Publishers, Englewood Cliffs, NJ. Norman, D. A. (1992): Turn Signals are the Facial Expressions of Automobiles, AddisonWesley Publishing Co., New York, NY. NORSOK Standard S-DP-001 (1996): Design Principles, Technical Safety, Revision 2, Oslo, Norway. Norwegian Standards (1990): Requirements for the Contractor's Quality Assurance, NS 5801 / NS 5803, Oslo, Norway. Nowak, A. S. (1979): "Effect of Human Error on Structural Safety," J. of the American Concrete Institute, Sept. Nowak, A. S. (1980): "Gross Error Models in Structural Safety," Proceedings Annual Convention, Portland, Oregon, American Society of Civil Engineers, Herndon, VA. Nowak, A. S. (1986): Modeling Human Error in Structural Design and Construction, Proceedings of a Workshop Sponsored by the National Science Foundation, American Society of Civil Engineers. Nowak, A. S. and Carr, R. I. (1985): "Classification of Human Errors," Proceedings Symposium on Structural Safety Studies, American Society of Civil Engineers, Denver, May. Nowak, A. S., and Lind, N. C. (1985): "Modeling Human Errors," Int. Assoc. of Bridge and Structural Engineers Symposium on Safety and Quality Assurance in Civil Engineering, IABSE Report 50. Nowak, A. S., Carr, R. I., Arafah, A. M., and Melgarejo, J. A. (1986): Modeling Human Errors in Structural Design and Construction, Report to National Science Foundation, Dept. of Civil Engineering, U. of Michigan, Ann Arbor, Michigan. Noyes, R. S. (1994): Evaluation of Error in the Sleipner A Design, Project Report NA 290C / CE290A, University of California at Berkeley. Orisamolu, I. R., and Bea, R. G. (1993): Reliability of Offshore Structural Systems: Theory, Computation, and Guidelines for Application, Report to Engineering Branch, Canadian National Energy Board, Calgary, Alberta, Canada. Orlikowski, W. J. (1996): “Improvising Organizational Transformation Overtime: A Situated Change Perspective,” J. Information Systems Research, Vol. 7, No. 1. Orr, G. E. (1983): Combat Operations in C&I: Fundamentals and Interactions, Air University Press, Maxwell Air Force Base, AL. Oswald, T. H., and Burati, J. L. Jr. (1992): Guidelines for Implementing Total Quality Management in the Engineering and Construction Industry, Report to the Construction Industry Institute, The University of Texas at Austin, June. 49 Oxaman, R. O., and Rivka, R. (1994): “Case-Based Design: Cognitive Models for Case Libraries,” Knowledge-Based Computer-Aided Architectural Design, G. K. Carrera and E. Yehuda (Eds.), Elsevier Science, Amsterdam. Paradies, M., Unger, L., Ramey-Smith, A. (1992): “Development and Testing of the NRC’s Human Performance Investigation Process (HPIP), Proceedings of the International Conference on Hazard Identification and Risk Analysis, Human Factors and Human Reliability in Process Safety, American Institute of Chemical Engineers, New York. Paragon Engineering Services Inc. (1997): Safety Assessment of Management Systems (SAMS) Joint Industry Project, Final Report, Report to Joint Industry Project, Houston, TX. Parsanejad, S. (1987): “Strength of Grout-Filled Damaged Tubular Members.” Journal of Structural Engineering, Vol. 113, No. 3, American Society of Civil Engineers, Herndon, VA. Paté Cornell, M. E. (1990): "Organizational Aspects of Engineering System Safety: The Case of Offshore Platforms," Science, Vol. 250, Washington, DC. Paté-Cornell M. E. and Bea, R. G. (1992): "Management Errors and System Reliability: A Probabilistic Approach and Application to Offshore Platforms", Risk Analysis, Vol. 12, No. 1. Paté-Cornell, E. and Bea, R. G. (1989): Organizational Aspects of Reliability Management: Design, Construction, and Operations of Offshore Platforms, Research Report no. 89-1, Department of Industrial Engineering. and Engineering. Mgt., Stanford University, Palo Alto, CA. Pate-Cornell, M. E. and Murphy, D. M. (1996): “Human and Management Factors in Probabilistic Risk Analysis: The SAM Approach and Observations from Recent Applications,” Reliability Engineering and System Safety, Vol. 53, Elsevier Science Ltd. Pearson, C. M., and Mitroff, I. I. (1993): “From Crisis Prone to Crisis Prepared: A Framework for Crisis Management,” Academy of Management Executive, Academy of Management, New York. Penwell, L (1990): “Leadership and Group Behavior in Human Space Flight Operations,” American Institute of Aeronautics and Astronautics, Alabama, Sept. Perrow, C. (1984): Normal Accidents: Living with High Risk Technologies, Basic Books Inc., New York, NY. Petroski, H. (1985): To Engineer is Human: The Role of Failure in Successful Design, St. Martins Press, New York, NY. Petroski, H. (1994): Design Paradigms, Case Histories of Error and Judgment in Engineering, Cambridge University Press, Cambridge, UK. Pfeffer, J. (1998): New Directions for Organization Theory, Oxford Publishers, New York. Phillips, L. D., Humphreys, D. E. & Selby, D. L. (1990): "A Socio-Technical Approach to Assessing Human Reliability," Influence Diagrams, Belief Nets and Decision Analysis, Ed. Oliver, M.R. & Smith, J.Q. Wiley & Sons, New York, NY. Pickrell, B., and Bea, R. G. (1997): Assessment of Human and Organization Factors in Operations of Marine Terminals and Offshore Platforms, Marine Technology and Management Group, University of California, Berkeley. 50 Pidgeon, N., and O’Leary, M. (1994): “Organizational Safety Culture: Implications for Aviation Practice,” Aviation Psychology in Practice, Washington, DC. Pidgeon, NO. F. (1991): “Safety Culture and Risk Management in Organizations,” J. of CrossCultural Psychology, Vol. 22, New York. Pitts, J., Kayten, P., and Zalenchak, J. (1995): The National Plan for Aviation Human Factors, U. S. Department of Transportation Federal Aviation Administration, Washington, DC. Popper, K. R. (1972): “Epistemology without a Knowing Subject,” Objective Knowledge: An Evolutionary Approach, Oxford University Press, London, UK. Pugsley, A. G. (1973): "The Prediction of Proneness to Structural Accidents." J.Structural Engineering, Vol. 51, No. 6, American Society of Civil Engineers, Herndon, VA. Puri, S. C. (1991): "Deming + ISO 9000, A Deadly Combination for Quality Revolution," American Society for Quality Control Congress, Milwaukee. Rackwitz, R., and Huillemeir, B (1983): "Planning for Quality," Proceedings of Int. Assoc. of Bridge and Structural Engineers Workshop on Quality Assurance within the Building Process, Rigi, Switzerland. Rackwitz, R., and Schrupp, K. (1985): “Quality Control, Proof Testing, and Structural Reliability,” Journal of Structural Safety, Vol. 2, Elsevier, London. Rasmussen, J. (1982): “Human Errors: A Taxonomy for Describing Human Malfunctions in Industrial Installations,” J. Occupational Accidents, Vol. 4, New York. Rasmussen, J. (1983): “Skills, Rules, Knowledge: Signals, Signs and Symbols and Other Distinctions in Human Performance Models,” IEEE Transactions: Systems, Man and Cybernetics, SMC-13, New York. Rasmussen, J. (1986): Information Processing and Human-Machine Interaction: An Approach to Cognitive Engineering, Series Vol. 12. Elsevier North Holland Inc., New York, NY. Rasmussen, J. (1995): “Market Economy, Management Culture and Accident Causation: New Research Issues?,” Proceedings of the Second International Conference on Safety Science, Budapest Organizer Ltd., Budapest, Hungary. Rasmussen, J., (1996): “Risk Management, Adaptation, and Design for Safety,” Future Risks and Risk Management, N. E. Sahlin and B. Brehemer (Eds.), Dordrecht, Kluwer. Rasmussen, J., Duncan, K., and Leplat, J. (Eds.) (1987): New Technology and Human Error, John Wiley & Sons, New York, NY. Rassumen, J. (1980): “What Can Be Learned from Human Error Reports?”, Changes in Working Life, K. Dunce, M. Gruneberg, and D. Wallis (Eds.), John Wiley, New York, NY. Rausand, M., and Vatn, J. (1998a): “Reliability Modeling of Surface Controlled Subsurface Safety Valves,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Rausand, M., and Vatn, J. (1998b): “Reliability Centered Maintenance,” Risk and Reliability in Marine Technology, C. G. Soares (Ed.) Balkema, Rotterdam, The Netherlands. Reason, J. (1990a): Human Error, Cambridge University Press, London, UK. 51 Reason, J. (1990b): "The Contribution of Latent Human Failures to the Breakdown of Complex Systems," Philosophical Transactions of the Royal Society, London, UK. Reason, J. (1991): "How to Promote Error Tolerance in Complex Systems in the Context of Ships and Aircraft," Safety at Sea and in the Air - Taking Stock Together Symposium, The Nautical Institute, London, UK. Reason, J. (1997): Managing the Risks of Organizational Accidents, Ashgate Publishers, Aldershot, UK. Reeve, H. P. and Bea, R. G. (1999). “SQIS: A Framework for the Development and Implementation of an Industry-Wide Ship Quality Information System,” Marine Technology, June, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Resnick, L. B., Levine, J. M., and Teasley, S. D. (Eds.) (1991): Perspectives on Socially Shared Cognition, American Psychologial Association, Washington, DC. Rettedal, W. K., Gudmestad, O. T., and Aarum, T., “Use of Risk Analysis in Offshore Construction Projects,” Proceedings of the Offshore Mechanics and Arctic Engineering Conference, Houston, Texas, American Society of Mechanical Engineers, New York, NY. Ricles, J. M., Bruin, W. M., Sooi, T. K., Gebor, M. F., Schönwetter, P. C., 1995. "Residual Strength Assessment and Repair of Damaged Offshore Tubular," Proceedings Offshore Technology Conference, OTC 7807, Society of Petroleum Engineers, Richardson, TX. Ring, P. S. and Van de Ven, A. H. (1989): “Formal and Informal Dimensions of Transactions,” Research on Management of Innovation: The Minnesota Studies, A. H. Van de Ven, H. L. Angle, and M. S. Poole (Eds.), Ballinger, New York. Ringstad, A. J., and Grundt, H. J. (1994): “The Synergi Project,” European Safety and Reliability Data Association Seminar on Maintenance and Databases. Rissland, E. L. S., et al (1996): “Using Heuristic Search to Retrieve Cases that Support Arguments,” Case-Based Reasoning – Experiences, Lessons, and Future Directions, American Association for Artificial Intelligence Press, The MIT Press, Cambridge, MA. Roberts, K. H. (1989): "New Challenges in Organizational Research: High Reliability Organizations," Industrial Crisis Quarterly, Vol. 3, Elsevier Science Publishers B. V. Amsterdam - Netherlands. Roberts, K. H. (1990a): "Managing High Reliability Organizations," California Management Review. Roberts, K. H. (1990b): "Top Management and Effective Leadership in High Technology," L. Gomez-Mehia and M. W. Lawless (Eds.), Research Series on Managing the High Technology Firm, JAI Press, Greenwich, CT. Roberts, K. H. (1994): "Functional and Dysfunctional Organizational Linkages," Trends in Organizational Behavior, Vol. 1, C. L. Cooper and D. M. Rousseau (Eds.), John Wiley & Sons Ltd., London, UK. Roberts, K. H. (Ed.) (1993): New Challenges To Understanding Organizations, McMillan Publishing Co., New York, NY. 52 Roberts, K. H., (1990c): “Some Characteristics of High Reliability Organizations,” Organization Science, Vol. 1, New York, NY. Roberts, K. H., and Bea, R. (1995): “Organization Factors in the Quality and Reliability of Marine Systems,” Proceedings 14th International Conference on Offshore Mechanics and Arctic Engineering, American Society of Mechanical Engineers, New York, NY. Roberts, K. H., and Libuster, C. (1993): "From Bhopal to Banking: Organizational Design Can Mitigate Risk," Organizational Dynamics, Spring, Academy of Management, New York. Roberts, K. H., and Rousseau, D. M. (1989): “Research in Nearly Failure Free High Reliability Systems: Having the Bubble,” IEEE Transactions on Engineering Management, Vol. 36, New York. Roberts, K. H., Stout, S. K., and Halpern, J. J. (1994):“Decision Dynamics in Two High Reliability Military Organizations,” Management Science, Vol. 40, New York, NY. Robinson, P. (1991): "Safety Performance and Organizational Culture: An Organization Perspective", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland. Roggeveen, V. (1991): "Controlling the Human Factor in Offshore Industry Safety", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland. Rohener, R. P. (1984): “Towards a Conception of Culture for Cross-Cultural Psychology,” Journal of Cross Cultural Psychology, Vol. 15, New York, NY. Ross, S. S. (1984): Construction Disasters: Design Failures, Causes and Prevention, McGrawHill, New York, NY. Roth, E. M., Mumaw, R. J., and Lewis, P. M. (1994): An Empirical Investigation of Operator Performance in Cognitively Demanding Simulated Emergencies, U. S. Nuclear Regulatory Commission, NUREG/CR-6208, Washington, DC. Rouse, W. B. (1980): Systems Engineering Models of Human Machine-Interaction, Series Volume 6, Elsevier North Holland Inc., New York, NY. Safe Marine Transportation Forum (1997): Marine Reporting – The Development of a Northwest Marine Safety Reporting System, Waterways Management Subcommittee, Safe Marine Transportation (SMARTR) Forum of Puget Sound, Seattle, WA. Salvendy, G. (Ed.) (1987): Human Error and Human Reliability: Handbook of Human Factors, John Wiley & Sons, New York, NY. Sanders, M., McCormick, E. J. (1993): Human Factors in Engineering and Design, 7th Edition, McGraw-Hill, New York, NY. Sarna, P. C. (1996): “Managing the Spike - The Command Perspective in Critical Incidents,” Applying CRM Methods and Best Practices in Developing High Performance Management Teams, Boeing Center for Leadership & Learning, Renton, WA. Schager, B. (1993): “A New Assessment System for Applicants to the Swedish Maritime Academy,” News, the Swedish Club, Goteborg, Sweden. Schein, E. H. (1985): Organizational Culture and Leadership, Jossey Bas Publishers, San Francisco, California. 53 Schein, E. H. (1996): “Kurt Lewin’s Change Theory in the Field and in the Classroom: Notes Toward A Model of Managed Learning, J. Systems Practice, Vol. 9. Schmidt, J. (1996) “Aeromedical Intervention Strategies in Maritime Systems” Paper Presented to the Committee on Human Performance, Organizational Systems, and Maritime Safety, National Research Council, Marine Board, Washington, DC. Schofield, S. (1998): “Offshore QRA and the ALARP Principle,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Schulte-Strathaus, R., and Bea, R. G. (1995): Ship Structural Integrity Information System, Report to Ship Structure Committee, SSC-380, Washington, DC. Schulte-Strathaus, R., and Bea, R. G. (1996): “SSIIS – The Ship Structural Integrity Information System,” Marine Technology, Vol. 33, No. 4, Society of Naval Architects and Marine Engineers, Jersey City, NJ. Senders, J. W., and Moray, N. (1990): Perspectives in Human Error, Erlbaum Publishers, Hillsdale, NY. Sevon, G. (1996): “Organizational Imitation in Identify Transformation,” Translating Organizational Change, B. Czarniawska and G. Sevon (Eds.), Walter de Gruyter Publishers, New York. Shapira, Z. (1995): Risk Taking – A Managerial Perspective, Russell Sage Foundation, New York. Sharp, J. V., Kam, J. C., Birkinshaw, M. (1993): "Review of Criteria for Inspection and Maintenance of North Sea Structures", Proceedings of 13th International Conference on Offshore Mechanics and Arctic Engineering, American Society of Mechanical Engineers, New York, NY. Shetty, N. K., Soares, C. G., Thoft-Christensen, P., and Jensen, F. M. (1998): “Fire Safety Assessment and Optimal Design of Passive Fire Protection for Offshore Structures,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Shibata, H. (1985): "Effect of Human Error for Structural Design Under Seismic Loadings and its Evaluation," Proceedings National Science Foundation Workshop on Civil Engineering Applications of Fuzzy Sets, National Science Foundation. Shinozuka, M. (1990): Relation of Inspection Findings to Fatigue Reliability, Ship Structure Committee, SSC-355, Washington, DC. Sills, D. L., and Merton, R. K. (Eds.) (1991): International Encyclopedia of the Social Sciences: Social Science Quotations, Vol. 19, Macmillan Publishers, New York. SINTEF Civil and Environmental Engineering (1996): Verification of Design, Annex 6, Manual for Design of Marine Concrete Structures, Trondheim, Norway. Slovic, P. (1997): “Trust, Emotion, Sex, Politics, and Science, Surveying the Risk-Assessment Battlefield,” M. Bazerman, D. Messick, A. Tenbrunsel, and K. Wade-Benzoni, (Eds), Environment, Ethics, and Behavior, The New Lexington Press, San Francisco, CA. Soares, C. G. (Ed.) (1998): Risk and Reliability in Marine Technology, A. A. Balkema, Rotterdam, The Netherlands. 54 Sowers, G. F. (1993): "Human Factors in Civil and Geotechnical Engineering Failures," J. Geotechnical Engineering, Vol. 109, No. 2, American Society of Civil Engineers, Herndon, VA. Spouge, J. (1999): A Guide to Quantitative Risk Assessment for Offshore Installations, Publication 99/100 CMPT 1999, ISBN I 870553 365, London, UK. Spritzer, G. M., and Quinn, R. E. (1996): “Empowering Middle Managers to be Transformational Leaders,” J. Applied Behavioral Science, Vol. 32. No. 3. Stacey, R. D. (1995): “The Science of Complexity: An Alternative Perspective for Strategic Change Processes,” J. of Strategic Management, Vol. 16. Stahl, B., Geyer, J. F., Shoup, G. J., Cornell, C. A., Vinnem, J. E., and Bea, R. G. (1992): “Methodology for Comparison of Alternative Production Systems (MCAPS),” Proceedings Offshore Technology Conference, OtC 6935, Society of Petroleum Engineers, Richardson TX. Stamler, J. H. (1993): The Dictionary for Human Factors, Ergonomics, CRC Press Inc., Boca Raton, FL. Staneff, S. T., Ibbs, W. C., and Bea, R. G. (1996): “Risk-Management System for InfrastructureCondition Assessment,” J. of Infrastructure Systems, Vol. 1, No. 4, American Society of Civil Engineers, Herndon, VA. Starbuck, W. H., and Milliken, F. J. (1988): Executives’ Perceptual Filters: What They Notice and How They Make Sense,” The Executive Effect: Concepts and Methods for Studying Top Managers, D. C. Hambrick (Ed.), JAI Publishers, Greenwich, CT. Stear, J. D., and Bea, R. G. (1996): Using Static Pushover Analysis to Determine the Ultimate Limit States of Gulf of Mexico Steel Template-Type Platforms Subjected to Hurricane Wind and Wave Loads, Report to U.S. Minerals Management Service and Joint Industry Project Sponsors, University of California at Berkeley, March. Stear, J. D., and Bea, R. G. (1997): Earthquake Analysis of Offshore Platforms – Screening Methodologies Project Phase III, Report to Joint Industry Project Sponsors, Marine Technology & Management Group, University of California at Berkeley. Stear, J. D., and Bea, R. G. (1998): TOPCAT – Template Offshore Platform Capacity Assessment Tools, Report to Joint Industry Sponsor Group, Marine Technology & Management Group, University of California at Berkeley. Stephens, K. G. (1998): “Using Risk Methodology to Avoid Failure,” Owning the Future – Integrated Risk Management in Practice, D. Elms, (Ed), Center for Advanced Engineering, Christchurch, New Zealand. Stewart, M. G. (1990): "Risk Management and the Human Dimension in Structural Design", Proc. First Int. Symposium on Uncertainty Modeling and Analysis, University of Maryland, Dec. Stewart, M. G. and Melchers, R. E. (1985): Human Error in Structural Reliability - IV Efficiency in Design Checking, Civil Eng. Research Reports, Monash University, Report No. 3. Stewart, M. G. and Melchers, R. E. (1986): Human Error in Structural Reliability - V: Efficiency in Self-Checking, Dept. of Civil Eng. and Surveying Research Report, The University of Newcastle, New South Wales, Australia. 55 Stewart, M. G. and Melchers, R. E. (1987): Human Error in Structural Reliability - VI: Overview Checking, Dept. of Civil Eng. and Surveying Research Report, The University of Newcastle, New South Wales, Australia. Stewart, M. G. and Melchers, R. E. (1988a): "Checking Models in Structural Design," J. of Structural Engineering, Vol. 115, No. 17, American Society of Civil Engineers, Herndon, VA. Stewart, M. G. and Melchers, R. E. (1988b): "Simulation of Error in a Design Loading Task," Structural Safety, Vol. 5., New York, NY. Stewart, M. G. and Melchers, R. E. (1989a): "Decision Model for Overview Checking of Engineering Designs," Int. J. of Industrial Ergonomics, Vol. 4., New York, NY. Stewart, M. G. and Melchers, R. E. (1989b): "Error Control in Member Design," Structural Safety, Vol. 6, New York, NY. Stoklosa, J. H. (1983): “Accident Investigation of Human Performance Factors,” Proceedings Second Symposium on Aviation Psychology, Ohio State University, Columbus, OH. Stone, J. R., and Blockley, D. I. (1993): "Hazard Engineering and Learning from Failures," Proceedings of ICOSSAR, London, UK. Stoner, J. A. F. (1961): A Comparison of Individual and Group Decisions Involving Risk, Master’s Thesis, School of Industrial Management, Massachusetts Institute of Technology, Boston, MA. Stoutenberg, S. Bea, R. G., and Roberts, K. H. (1995): Human and Organizational Errors in Loading and Discharge Operations at Marine Terminals: Reduction of Tanker Oil and Chemical Spills: Engineering to Minimize Human and Organizational Errors, Report to Sea Grant College Program, Sea Grant Project R/OE 28, Marine Technology and Management Group, University of California at Berkeley. Strutt, J. E., Sharp, J. V., Busby, J. S., Deasley, P. J., Tourle, N., Yates, G., Hughes, G., and Miles, R. (1998): “Development of Design Performance Indicators for Improved Safety Offshore,” Proceedings ERA Conference, London, UK. Swain, A. D. & Guttman, H. E. (1983): Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, U. S. Nuclear Regulatory Commission, Washington, DC. Swain, A. D. (1963): A Method for Performing a Human-Factors Reliability Analysis, Sandia Corporation Monograph SCR-685, Albuquerque, NM. Swain, A. D. (1978): Estimating Human Error Rates and their Effects on System Reliability, Sandia Corporation Report SAND-1240, Albuquerque, NM. Sylvester-Evans, R. (1991): "Management and Organizational Failings Leading to Major Accidents", Proc. Human Factors in Offshore Safety Conference, Aberdeen, Scotland. Szwed, P. S., and Bea, R. G. (1998): Development of a Safety Management Assessment System for the International Safety Management Code, Marine Technology and Management Group, College of Enigneering & Haas School of Business, University of California at Berkeley. Thompson, P. and Perry, J. (1992): Engineering Construction Risks, Thomas Telford, London, UK. 56 Trbojevic, V. M., and Bellamy, L. J. (1995): “Practicalities and Benefits of Conducting Risk Assessment of the Design Process,” Proceedings Conference on Assessing and Minimizing Risk in the Design, Construction, and Installation of Offshore Structures, Institution of Engineers, London, UK. Trbojevic, V. M., Bellamy, L. J., Brabazon, P. G., Gudmestad, O. T., Rettedal, W. K. (1994): “Methodology for the Analysis of Risks During the Construction and Installation Phases of an Offshore Platform,” Journal of Loss Prevention, Process Industries, Vol. 7, No. 4, New York, NY. Tromans, P. S. and van de Graaf, J. W., 1992. "A Substantiated Risk Assessment of a Jacket Structure." Proceedings Offshore Technology Conference, OTC 7075, Society of Petroleum Engineers, Richardson, TX. Turban, E. (1995): Decision Support and Expert Systems: Management Support Systems, Prentice Hall Publishers Inc., New York. Turner. B. A. (1978): Man-Made Disasters, Wykeham Publishers, London, UK. Turner, B. A. (1991): “The Development of a Safety Culture,” Chemistry and Industry, April, New York, NY. Turner, J. H. (1987): “Toward a Sociologial Theory of Motivation,” American Sociological Review, Vol. 52, New York. Tushman, M. L., and O’Reilly, C. A. (1996): “The Ambidextrous Organization: Managing Evolutionary and Revolutionary Change, California Management Review, Vol. 38. Tversky, Al, and Kahneman, D. (1983) “Extensional Versus Intuitive Reasoning: the Conjunction Fallacy in Probability Judgment, Psychological Review, Vol.. 90, pp. 293-315. U. K. Department of Energy (1990): The Public Inquiry into the Piper Alpha Disaster, The Hon. Lord Cullen, Vols. 1 and 2, HMSO Publications, London, UK. U. K. Ministry of Defense (1988): Human Factors for the Designers of Equipment, Defense Standard 00-25: Parts 1-13, Directorate of Standardization, Glasgow, Scotland. U. K. P&I Club (1993): Analysis of Major Claims, The United Kingdom Mutual Steam Ship Assurance Association (Bermuda) Ltd., London, UK. U. S. Coast Guard (1995): Prevention Through People, Quality Action Team Report, Washington, DC. U. S. Department of Commerce, National Bureau of Standards (1985): Application of Risk Analysis to Offshore Oil and Gas Operations, Proceedings of an International Workshop, NBS Special Publications 695, Washington DC. U. S. Department of Defense (1979): Human Engineering Requirements for Military Systems, MIL-HG-43685B, U. S. Government Printing Office, Washington, DC. U. S. Department of Defense (1989): Military Standard: Human Engineering Design Criteria for Military Systems, Equipment, and Facilities, MIL-STD-1472D, U. S. Government Printing Office, Washington, DC. 57 U. S. Department of Defense (1995): Formal Safety Program, MIL-STD 882C, Air Force Material Command, Wright-Patterson Air Force Base, OH. Underwater Engineering Group (1982): Review of Repairs to Offshore Installations, UR21, London. Underwater Engineering Group (1989): Underwater Inspection of Steel Offshore Installation: Implementation of a New Approach, Final Report to industry sponsors, London, June. United Airlines Inc. (1996a): Command / Leadership / Resource Management, Reference Document, Denver, Colorado. United Airlines Inc. (1996b): Flight Operations Manual Policies: Command / Leadership / Resource Management, Jeppesen Sanderson Publishers, Chicago, IL. Van Cott, H. P., Kinkade, R. G. (Eds) (1992): Human Engineering Guide to Equipment Design, McGraw-Hill Book Co., New York, NY. Van de Ven, A. H., Poole, M. S. (1995): “Explaining Development and Change in Organizations,” Academy of Management Review, Vol. 20, No. 3. Varela, F. J., Thompson, E., and Rosch, E. (1991): The Embodied Mind: Cognitive Science and Human Experience, MIT Press, Cambridge, MA. Vatn, J. (1998): “A Discussion of the Acceptable Risk Problem” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Vaughan, D. (1996): The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA, University of Chicago Press, Chicago, IL. Vaughan, D. (1997): “The Trickle-Down Effect: Policy Decisions, Risky Work, and the Challenger Tragedy,” California Management Review, Vol. 39, No. 2, University of California, Berkeley, CA. Veritec (1984): Offshore Reliability Data Handbook (OREDA), 1st Edition. Penn Well Books, Dallas, TX. Veritec (1988): The Worldwide Offshore Accident Data Bank (WOAD), Annual Reports through 1988, Oslo, Norway. Vinnem, J. E. (1993): "Application and Defensibility of Offshore QRA (Quantified Risk Assessment): Case Study Discussion," Proceedings of the 12th International Conference on Offshore Mechanics and Arctic Engineering, Vol. II, Glasgow, Scotland. Vinnem, J. E. (1998): “Evaluation of Methodology for QRA in Offshore Operations,” Reliability Engineering and System Safety, Vol. 61, Elsevier Science Limited, London, England. Vinnem, J. H. and Hope, B. (1986): Offshore Safety Management, Tapier Publishers, Trondheim, Norway, 1992. Wagenaar, W. A., and Groeneweg, J. (1987): “Accidents at Sea: Multiple Causes and Impossible Consequences,” International Journal of Man-Machine Studies, Vol. 27, pp. 587-598. Wagennar, W. A., Hudson, P. T. W., and Reason, J. T. (1990): "Cognitive Failures and the Causes of Accidents," Applied Cognitive Psychology, Vol. 2, New York, NY. 58 Walker, A. C. (1980): "Study and Analysis of the First 120 Failure Cases," Proceedings of the Symposium on Structural Failure in Buildings, Institution of Structural Engineers, London, UK> Waterman, R. H., Jr. (1990): Adhocracy: The Power to Change, Whittle Direct Books, Memphis, TN. Watson, I. A. 1986): “Human Factors in Reliability and Risk Assessment,” The Safety Practitioner, New York. Watson, S. R. (1994): “The Meaning of Probability in Probabilistic Safety Analysis,” Reliability Engineering and System Safety, Vol. 45, Elsevier Science Ltd., London, UK. Weaver, L., Lyon, W. A., and Price, H. E. (1992): “Prevention of Pollution from Spills: the Human-Machine Interface Factor,” Water Science Technology, Vol. 26, No. 7-8, Great Britian. Weick, K. E. (1979): The Social Psychology of Organizing, Addison-Wesley Publishers, Reading, MA. Weick, K. E. (1987): "Organizational Culture as a Source of High Reliability," California Management Review, Winter, University of California at Berkeley. Weick, K. E. (1995a): Sensemaking in Organizations, Thousand Oaks, CA: Sage. Weick, K. E. (1995b): “South Canyon Revisited: Lessons from High Reliability Organizations,” Draft Manuscript, University of Michigan Business School, Ann Arbor, Michigan. Weick, K. E. and Quinn, R. E. (1999): “Organizational Change and Development,” Annual Review of Psychology, New York. Weick, K. E., and Roberts, K. H. (1993): “Collective Mind in Organizations: Heedful Interrelating on Flight Decks,” Administrative Science Quarterly, Vol. 38., New York, NY. Weick, K. E., Sutcliffe, K. M., and Obstfeld, D. (1998): “Organizing for High Reliability: Processes of Collective Mindfulness,” Research in Organizational Behavior, Stow and Sutton (Eds.) Wenk, E. (1988): Making Waves, Columbia Press, New York. Wenk, E., Jr. (1986): Tradeoffs, Imperatives of Choice in a High-Tech World, The Johns Hopkins University Press, Baltimore, MD. Wenk, E., Jr. (1998): The Double Helix: Technology and Politics, Manuscript Prepared for Publication, University of Washington, Seattle, WA. Wiener, E. L, and Nagel, D. C. (Eds.) (1989): Human Factors in Aviation, Academic Press, New York, NY. Wiley, N. (1988): “The Micro Macro Problem in Social Theory,” Sociological Theory, Vol. 6, New York, NY. Williams, J. C. (1988): "A Data-Based Method for Assessing and Reducing Human Error to Improve Operational Experience," Proceedings of IEEE, 4th Conference on Human Factors in Power Plants, Monterey, California, June. Williams, J. C. (1996): Assessing the Likelihood of Violation Behavior: A Preliminary Investigation, Report, Department of Psychology, University of Manchester, Manchester, UK. 59 Winkworth, W. J., and Fisher, P. J. (1992): “Inspection and Repair of Fixed Platforms in the North Sea,” Proceedings Offshore Technology Conference, OTC Paper 6937, Society of Petroleum Engineers, Richardson, TX. Winograd, T., and Flores, F. (1986): Understanding Computers and Cognition: A New Foundation for Design, Ablex Publishers, Norwood, NJ. Wirsching, P. H. and Chen, Y. N. (1992): “Considerations of Probability Based Fatigue Design for Marine Structures,” Marine Structural Reliability Symposium, Ship Structure Committee and Society of Naval Architects and Marine Engineers, New York, NY. Woods, D. D. (1990): “Risk and Human Performance: Measuring the Potential for Disaster,” Reliability Engineering and System Safety, Vol. 29, Elsevier Science Publishers Ltd., England. Woods, D., et al. (1994): Behind Human Error: Cognitive Systems, Computers and Hindsight, State of the Art Report, Wright-Patterson Air Force Base, Dayton OH. Woodson, W., Tillman, B., and Tillman, P. (1981): Human Engineering Design Handbook, McGraw Hill Publishing Co. New York, NY. Wright, M. S., Bellamy, L. J., Brabazon, P. G., and Berman, J. V. F. (1992): Audit Methods for the Evaluation and Management of Risk, Final Report and Appendices, Report to the Health and Safety Executive, London, UK. Wu, J. S., Apostolakis, G. E., and Okrent, D. (1989): “On the Inclusion of Organizational and Management Influences in Probabilistic Safety Assessments of Nuclear Power Plants,” Proceedings of the Society for Risk Analysis, New York. Xu, T., and Bea, R. G., 1996, In-Service Inspection for Ship and Offshore Structures, Report to Joint Industry Research Project, Marine Technology and Management Group, Department of Civil & Environmental Engineering, University of California at Berkeley. Yamamoto, M. and Ang, H-S. (1985): "Significance of Gross Errors on Reliability of Structures," Proceedings of ICOSSAR'85, Vol. III, Japan. Yang, J. N. (1976): "Inspection Optimization for Aircraft Structures Based on Reliability Analysis," J.of Aircraft, AAIA Journal, Vol. 14, No. 9, New York, NY. Yang, J. N. (1993): "Application of Reliability Methods to Fatigue, Quality Assurance and Maintenance", Proceedings of the 6th International Conference on Structural Safety and Reliability, ICOSSAR 93, University of Innsbruck, Austria. Yang, J. N. and Chen, S.(1985): "Fatigue Reliability of Structural Components Under Scheduled Inspection and Repair Maintenance," Probabilistic Methods in Mechanics of Solids and Structures, S. Eggwertz and N. C. Lind, (Eds), Springer-Verlag, Berlin. Yates, J. F., Klatzky, R. L., and Young, C. A. (1995): Cognitive Performance Under Stress, Emerging Needs and Opportunities for Human Factors Research, National Research Council, National Academy Press, Washington, DC, 1995. Yerkes, R. M, and Dodson, J. D. (1908): “The Relation of Strength of Stimuli to Rapidity of Habit Formation,” J. Comparative Neurological Psychology, Vol. 18, New York. Zimmermann, H. J. (1991): Fuzzy Set Theory and Its Applications, Kluwer Academic Publishers, London, UK. 60 Zohar D. (1980): “Safety Climate in Industrial Organizations: Theoretical and Applied Implications,” J. Applied Psychology, Vol. 65, No. 1, New York. 61 APPENDIX B Root Cause Analysis of the Initiating Blowout Failure of the Oroville Dam Gated Spillway Failure Background On January 27, 2017, a ‘hole’ in the Oroville Dam concrete gated spillway ‘chute’ was discovered and documented by photographers. Eleven days later, on Feb 7, 2017, the spillway catastrophically broke apart forming a gaping hole where a number of spillway concrete slabs were fractured, separated and lifted away. The Spillway flow was at 18% of its design ratings when the blowout failure occurred. For the failure to occur at such a low margin of the rated structural capacity when it had survived much larger flow rates indicates that a degradation of the integrity of the spillway occurred over time. Original design defects and flaws were ingrained into the spillway from construction decisions [1]1, which over time were compounded by ineffective inspections and maintenance to address the degradation effects induced from the original defects and flaws and from spillway operations. The spillway operated at 162,500 cubic feet per second flows in the "New Years Flood" in January 1997 with no incidents [2]. This high spillway flow rate was at an operational level of 55% of the rated spillway design capacity, yielding a 45% remaining margin of capacity. This evidence establishes a reference to an "empirical uneventful performance" in a spillway operational structural condition that was near 300% above the failure in 2017, while uneventful at 55% of the rated spillway structural capacity in 1997. This evidences a structural capacity reference to the severity of the "degradation" of the integrity of the spillway over time. Defects, Flaws, and Maintenance Degradation to Failure Examination of 1969 photographs reveal that the initial drainage of the spillway showed very little water drainage flows (Fig. B.1). Faint moisture marks are observable as darkening from wetting of the sidewall concrete. The spillway water flow was light. Comparing near identical conditions to those of the January 27, 2017 photograph (Fig. B.2) reveals "jetting" drainage flows from a lighter water flow to the identical sidewall drain locations (a, b, c, d, in Fig. B.1). Large foundation voids and flow channels under the concrete slabs would be required for this volume of water flows from the drains. Further, the January 2017 image reveals this volume of underflow is "recaptured" through water re-penetration into the gaps, seams, and drain line cracks in the slabs. Fig. B2 reveals the full extent of the evidence of the extensive foundation gaps, voids, and channels that have formed over time resulting in the                                                                                                                 1  References  at  the  end  of  Appendix  B.   1   current state of "jetting" sidewall drains from a simple "light flow". To some degree, there is a complex "secondary spillway" flow system parallel to and beneath the concrete ‘surface’ spillway. Degradation of the Spillway from Flaws, Decisions, Maintenance over Time California Department of Water Resources (DWR) Final Construction Report FCR 65-09 [13] and DWR Final Geology Report C-38 [12] reveal that DWR constructed the spillway with serious design flaws that led to a significant structural integrity loss over time, and which ultimately resulted2 in the blowout failure seen on February 7, 2017. Included in these critical design flaws were decisions made by DWR Field Engineers to restrict contractors from following design specifications [15] to excavate to sound competent rock or remove incompetent rock and soil and fill the voids with concrete, thus constructing large parts of the invert chute concrete on highly erodible foundation materials. The following sequence of developments evidences the answer to the 1969 to 2017 comparison photograph of critical changes to the spillway over time - changes developed by operational flood control releases: 1. DWR Field Engineer restricts contractor from following excavation specifications to competent rock. (Fig. B.17). Thus, large and deep seams of clay or highly erodible soil-like material remain - open to deep erosion - open to forming large voids, and open to significant degradation of slab anchorage upon future spillway operation. 2. DWR Geology Engineering design changed from the original HYD-510 and Bulletin 200 design drawings [15] (noted as emplaced upon rock or base concrete) to the change to allow emplacement upon a layer of clayey "fines" before pouring the spillway concrete slabs. (Fig. B.16) [12, 13]. 3. DWR used compacted clayey material (fines) to level the irregular subsurface rock grade (Fig. B.18). This material was highly erodible from subsurface water flow. In addition, the degraded and erodible ‘incompetent rock’ (Fig. B.10 and Fig. B.11) was not excavated and backfilled with concrete as required by the spillway design.1 4. Construction used wide amounts of side drain "round gravel filter rock" next to drain pipes forming a larger area of loss of slab structural integrity - thus contributing to the consistent pattern of drain line cracks in slabs above drain lines in conjunction with the flawed design of emplacing the drains within the slab causing a "thinning" the slab thickness dimensions (Fig. B.19, Fig. B.12). 5. DWR allowed the slab anchors to be installed in clay seams. Anticipated that the anchor bars would work in the "worst foundation available". Did not take into account any water penetration from slab seams and scouring erosion of these areas of "worst foundation available". Anchorage thus reduced to a highly degraded ability to perform (or                                                                                                                 2  "Resulted"  from  decades  of  lack  of    proper  recognition  and  understanding  of  these  original  flaws  and  the   lack  of  appropriate  effective  remedial  actions.     2   none). (Fig. B.20). Blowout failure area evidences that anchorage loss was a primary structural contributor to the failure. Loss of Spillway Structural Foundation over Time Due to the Design Flaws, Design Changes, Construction Flaws, and Flawed Field Engineering decisions, each flood control operation of the Oroville Spillway degraded the concrete spillway in its foundational and anchorage structural integrity. Penetrating water flows into and under the slabs created "scouring erosion" conditions to where the compacted clay "fines" layer was carried off through the course drain rock and out through the drains to the spillway. This same process eroded and transported fines deeper within the slab foundation to where voids formed (Ref. [17], Figs. B.3, B.4, B.5). Continued flood control operational spills developed piping channels and voiding areas to where "void repairs" became necessary. As the foundation became less structurally sound, and the slabs had the design "flaw" of wide base "thin" zones from the upward emplaced drain pipe, cracks formed pervasively in the slabs (Fig. B.7, Fig. B.19) [1][16]. These near 5 linear miles of cracks above the drains (Ref. [16], Fig. B.1) created a significant increase in pressurized water flow penetration into and under the slabs, thus accelerating the piping erosion process. The 2017 Board of Consultants recognized a high water flow problem and noted: "The amount of drain water flowing from the pipe discharge openings along the spillway training walls seems extraordinarily large."[4]. The loss of spillway structural foundation developed over time due to the following: 1. Excessive Foundation loss from High Volume Scouring Under-slab Erosion [1]. The March 10, 2017 BOC report revealed that this serious issue of "void" formation has been "found and repaired in the past". Quoting the report: "It seems likely that piping of foundation material beneath the chute slab may be responsible for the voids that have been found and repaired in the past." 2. Evidence of Voids forming to 9+ feet deep. [17]. DWR maintenance repairs clogging drains by injecting deep void filling material (concrete/grout) to where drain sections became non-functional (up to 1,780 feet of drains broken that service 36,500 square feet of two spillway areas) Fig. B.2 - circled sidewall drains to a non-functional total 1,780 feet of drains. Thus forcing erosive flow deeper and re-routing the deeper channels to other areas beneath the spillway. 3. Excessive Drain Flow 'Jetting' from Sidewall Outlets signal Alarm in Spillway Slab Cracks & Poor Sealing of Slab seams (photograph of fire-hose "jetting" of sidewall drains) [16]. 4. Excessive pressurized subsurface slab water flows. The DWR Board of Consultants (BOC) confirming the issue of the volume of the pressurized subsurface slab water flows in their March 10, 2017 BOC Memorandum No. 1 [4]. Quoting the report: "The amount of drain water flowing from the pipe discharge openings along the spillway training walls seems extraordinary large." "It appears also that the drains are collecting leakage through cracks in the chute slab and/or defects in the construction joints between the slabs. The drains appear to flow for some appreciable time after the gates are closed." 3   The DWR Oroville Dam Spillway Incident Forensic Investigation Team recognized these issues; from May 5, 2017 Memorandum [9] - items from list: 1. "16. Weathered rock and completely weathered rock that is soil-like material as slab foundation, without appropriate modification of the chute slab design, resulting in potentially erodible material beneath the slab and lack of foundation bond with concrete;" 2. "17. Less rigorous foundation preparation, resulting in lack of foundation bond with concrete." 3. "19. Insufficient anchorage, due to limited anchor development in the concrete, short anchor length, inadequate grouting or grout strength, and/or installation in weak foundation material." Flawed Maintenance Repairs Propagated and Increased the Spillway Degradation In 2009, DWR Spillway repair bids and line item documentation, prepared by DWR engineering, noted that 240 linear feet of drains were identified to be repaired [7][11]. A 2007 photograph reveals that one section of the spillway drains (10 drains spaced 20 feet apart servicing 18,250 square feet of spillway drainage area) were non-functional revealed by the sidewall drain nonoperation (Fig. B.4). After the 2009 contract repairs, the same drain section remained non-functional as evidenced in a 2013 photograph (Reference [17] Figs. 1 and 14). 2017 photographs reveal that 1,780 linear feet of slab drains that service 36,500 square feet of spillway drainage area were non-functional (Fig. B.2). Despite the DWR drain repair identification of 240 linear feet, the drains were not repaired. Inspections by the Division of Safety of Dams (DSOD), and the Federal Energy Regulatory Commission (FERC) should have identified such a severe non-functional drainage condition in the spillway. As the non-functioning drain state is observable from the sidewall drain & water seepage patterns, a visual inspection would have discovered this issue. The cited evidence documents that this non-functional drain state was not recognized nor repaired for close to 10 years (Nov 2007 to Jan 2017). Had DSOD, or FERC properly recognized this issue, an investigation would have revealed the source of the widespread ‘clogging’ of the drains and remedial action could have been initiated. This Failure of Inspection from multiple agencies, and for nearly a decade, is perhaps one of the greatest failures in the critical process of insuring the safety and integrity of the spillway. In summary: 1. DSOD, and FERC failed to recognize the significant problem of two nonfunctional sidewall drains which serviced 36,500 square feet of under-slab drainage for a span of 9 years 3 months. 2. DWR engineering noted 240 linear feet of drain line were to be repaired in 2009 4   [11]. In 2013 the drains remained non-functional (Reference [17] Fig. 14). DWR Maintenance and Engineering failed to address this issue. 3. Evidence identifies that Maintenance repairs of "deep void" filling (forming Large Concrete Slab blocks), with up to 9+ feet deep voids under the spillway, would have clogged the open ends of "dropped" drains [17] (Reference [17], Figs. 3, 4, 5, 6, 8, 10). 4. Seepage Evidence in 2013 identifies that water flow submarines below the large void block concrete filled non-functional drain area (left side view Ref [17], Fig. 14) and the seepage re-appears immediately downslope. 5. Evidence DWR failed to notify FERC on the issue of "deep void" filling repairs. Dam owners are required to notify FERC of any serious Potential Failure Modes (PFM's) [18]. 6. The second non-functional drainage area is directly upslope to the blowout failure initiation location (Fig. B.5). This condition would combine a large volume of non-captured under-slab flow to the next set of downslope drains. A higher volume of pressurized water flow increases the scouring erosion of weak foundation material identified in the blowout failure region. From the evidence of the "clogging" of injection of large "void filling" from Reference [17], the same process of deep erosion (and potential injecting induced "clogging") could render drains inoperable by either "dropping" drain pipe or "clogging" to where they are unable to service flows. The DWR Oroville Dam Spillway Incident Forensic Investigation Team recognized "plugging" or "collapse" of drains; from May 5, 2017 Memorandum [9] – items: 1. "11. Plugging or collapse of drains or collector pipes, including potential plugging by tree roots." 2. "12. Flow into the foundation that exceeded the capacity of the drain pipes, including flows from areas adjacent to the chute." Loss of Anchorage The loss of the spillway foundation integrity caused a significant structural integrity degradation of slab anchorage in the spillway anchor bars. DWR engineers had not considered the design consequences that would result in the high volume of pressurized water flow under the spillway slabs. Using the experimental data generated by the U.S. Bureau of Reclamation (Fig. B.13), a single drain system (10 drains spaced 20 feet apart) with a simple example of one seam per slab (0.125 effective seam width, 1/2 inch offset, 90 feet per second flow rate) could yield up to 55 cubic feet per second of total sub-slab water flow. This example flow rate would scour the full length of a 200 foot (18,250 square feet) slab array of eight slabs plus the sidewall slab area. As anchor bars were intended to be emplaced in the "worst foundation available”; DWR Field Engineers restricted contractors from excavating to competent rock; and DWR Final Geology Report Spec 65-09 illustrated the poor quality highly 5   erodible foundation "wide seam area" (Fig. B.21); a significant penetrating pressurized sub-slab water flow in highly erodible foundation material, over time, would render the anchorage resistance to a dangerously degraded structural retention state. In summary: 1. Three 40 feet by 50 feet slabs, with a combined 60 anchor bars, failed in the initial blowout failure. The fourth slab, to the left, was partially anchored on a section of "more competent rock" and it survived the initial blowout (Fig. B.10). This evidences the severe lack of structural integrity of the anchorage of the slabs as the image reveals the anchor bars were emplaced in highly weathered rock (poor) foundation material (light to brown color). 2. Non-functional drainage increased a sub-slab scouring erosion flow at the blowout failure slabs. The increased sub-slab scouring erosion on highly erodible material (noted in DWR Final Geology Report Spec 65-09 Fig. B.21) would have seriously degraded the anchorage strength in eroding at/near/around the anchor bar grout holes. Structural Degradation from Reinforcement Steel Corrosion at Slab Cracks Post Spillway failure evidence reveals a highly corroded state of reinforcing bar across cracks in the slabs (Figs. B.14, B.15). The cracks (Fig. B.7) developed from the thinning zones or weak zones in the spillway slabs induced by the upward emplacement design flaw of the drain design, including the wide side slopes of filter gravel next to the pipe (Fig. B.19). The corrosion was so extensive in an investigative saw cut near a drain line in the upper spillway (Fig. B.15) that the crumbled remains of the original rebar formed an orange "stain" in the cut surface. Nothing remained of the original reinforcement steel core. The severely corroded evidence in Fig. B.14 was in a multi-slab fracture above a drain line run. This evidences that the structural integrity of spillway slabs were greatly affected by the combination of slab cracks above the drain lines; where water flow penetrated these full depth slab cracks (Fig. B.7); and the water, over time, induced a significant degree of corrosion to where there was near total disintegration -if not fully- in the rebar transitioning these cracks. As each slab has 2 to 3 drain transverse under-slab drain lines, each slab thus faces a structural integrity risk along these cracks from the loss of reinforcement bar strength (tensile) in combination with a pre-cracked state (compressive) above the drains. Thus, this corrosion induced loss of reinforcement steel integrity, along drain line cracks, forced each "drain line separated" section of a slab to become highly dependent upon individual anchor bars. This would result in "highly degraded susceptible" areas of the spillway as there would be a loss of shared anchorage integrity to each slab in combination to the structural integrity losses from highly weathered rock foundation material. 6   In summary: 1. Saw Cut in Upper Spillway (Fig. B.15), for a drain inspection, reveals a complete decomposition of a number of reinforcement bars transitioning the drain (upslope/downslope orientation across the drain). The saw cut reveals an "orange stain" from the complete decomposition of the steel rebar. 2. Fracture of Upper Spillway Failure section along a drain line reveals highly corroded reinforcing steel along the slab & drain line crack location. Only one location shows sign of a thin diameter of remaining reinforcing steel. The DWR Oroville Dam Spillway Incident Forensic Investigation Team recognized this potential failure contribution issue; from May 5, 2017 Memorandum [9] - "5. Corrosion and failure of reinforcing bars across cracks" . A "Hole" in the Spillway - Blowout Failure Initiation High resolution original photographic forensic evidence reveals that a 7.9 foot by 14 inch "hole" was observed in the spillway Jan 27, 2017 (Fig. B.9). On Feb 7, 2017, at a flow rate of 54,500 cubic feet per second, DWR discovered a large amount of debris coming out of the concrete invert chute spillway [19]. DWR stopped all releases to inspect the spillway damage. What was discovered was a Blowout Failure area of nine slabs and partial destruction of four additional slabs (Fig. B.10). The DWR Independent Board of Consultants (BOC) noted that the failure "initiated" at this "hole" in the spillway [3]. The BOC also noted that the hole was likely to the depth of the layer of the slab rebar. Other examples of concrete spalling and/or delamination, forming "holes", to the depth to the slab reinforcing steel is revealed in the Upper Spillway (Fig. B.6, 2017 photograph). In summary: 1. March 17, 2017 BOC Memorandum No. 2 – “These photos show that failure was initiated at the hole at the left side of the chute near station 33+00. The failure, likely occurred as a result of high velocity flow (in the range of 85 to 90 feet per second), penetrating under the slab, causing a strong uplift force and causing the slab to lift, eventually causing all or part of the slab to break away. Subsequent erosion of foundation material caused progressive failure both upstream and downstream.” 2. DWR photographs of concrete spalling and/or delamination “holes” – workers observed patching “repairs” of the Upper Main Spillway of these holes. All “holes” observed at slab seam joints. Two “holes” observable in Fig. B.6 close to the Spillway Radial Gate Structure. Rows of “lines”, in a forensic zoom, infers concrete spalling or delamination depth to steel reinforcement layer in the slabs. The DWR Oroville Dam Spillway Incident Forensic Investigation Team recognized this potential failure contribution issue; from May 5, 2017 Memorandum [9] - "22. Spalling and/or delamination of concrete at slab joints." 7   Initial Blowout Failure Forensic Analysis Processes Forensic Process (A): Confirmation of evidence that the "hole" and the "blowout failure" initiated at the same spillway seam is revealed in a forensic overlay of high resolution photographs (Fig. B.2 Jan 27, 2017 hi-resolution photograph overlay with an aligned angle Post Blowout Feb. 7, 2017 photograph). Using a high-end workstation system with a hi-resolution graphics array, a process of pixelated shifting of the overlay transparency on the images allows a precision forensic analysis (i.e. all x,y dimensions scale matched in the image overlay alignment to a high degree of precision as revealed in the electrical towers, sidewalls, trees, headworks, and to the lower chute). The overlay included a side-by-side scaled alignment photograph of the turbulent erosion and breakup damage from flows in the "blowout hole" (source ref. [6]). Horizontal black lines provide reference points for forensic comparison of the turbulent erosion damage to the original blowout failure. The "hole" precisely aligns at the spillway slab seam that had the "blowout failure" (Fig. B.3). The image section to the right reveals the brown colored erosion flow that is following the section of destroyed downslope slabs. Forensic Process (B): To determine important historical concrete repair evidence at this "failure seam", a high resolution image pixelated zoom provided the upslope x,y slab seam locations relative to the sidewall drain to locate the seam. Satellite imagery from multiple years provided the concrete cuts, patches, and repairs for this seam to the full width of the 178 ft. chute. It was discovered that this seam is one of two seams in the entire 3000+ foot spillway that has the most extensive concrete repairs, cuts, patching, and resurfacing across a full width of the concrete chute. (note: the other location is near 500 ft. of the Headworks in the Upper Spillway). The very extensive repair history on this 178 ft. wide seam strongly evidences a structural issue affecting the abutting upslope and downslope slabs. Fig. B.8 reveals this seam with graphic overlay of the extensive concrete repairs to these upslope and downslope slabs at this seam junction. Forensic Process (C): Using the workstation and with a high resolution source photograph, the dimensions of the seam "hole" were measured to be 7.9 feet by 14 inches with a slight taper in the sidewall direction (Fig. B.9). Note: the Fig. B.9 image is a wide view image of the hole for seam reference notations - High resolution forensic photo zoom not included in this report. The seam "hole" is marked in red on the composite image. Physical Root Cause Failure Analysis The Physical Root Cause Failure Analysis of initiating blowout sequence of the Spillway is summarized in the following: 1. Fig. B.8. Initial failure "hole" defect initiation point of the Initial Blowout Failure Area of slabs along this extensively repaired spillway seam. Hole dimension measured with forensic high resolution photographs to be near 7.9 feet along the seam by 14 inches downslope from the seam. White lines denote the drain line cracks in the slab surface. The depth of the "hole" is inferred to be three inches deep to the upper layer of rebar - as evidenced in prior concrete spalling spontaneous defect occurrences revealed in Fig. B.6. This depth was also noted by the DWR Board of 8   Consultants Memorandum No. 2 (depth to rebar layer), page 8 [3]. 2. Fig. B.10. Initiating Failure Hole location reveals a deep seam of highly erodible foundation material that is many feet deeper than the grouted 5 foot deep slab anchor bars. Angle of seam inferred by dashed line. Image reveals the nature of why the "hole" location and that full 178 foot wide seam area was a structural problem area. The upslope "soil-like" foundation material is in a transition zone of more competent rock (downslope from the dashed line). Thus the "communicating" slab forces through the load transfer bars would have experienced a differential in structural integrity or stability. 3. Fig. B.11. Blowout Failure slabs located at a transition zone of higher integrity anchorage stability slabs verses slabs emplaced on poor anchorage stability based slabs above "soil-like" erodible foundation material. Net foundation structural anchorage "differential" placed forces on problem area seam as evidenced by the extensive concrete repairs along this full 178 foot wide seam area. 4. Fig. B.21. DWR Official Final Geology Report Spec 65-09 denotes the foundation geology of the subgrade quality of foundation material that the invert concrete chute was constructed upon. The Seam (marked as a series of "S"'s) follows the dashed line seam in Fig. B.10. This drawing reveals the same foundation structural integrity transition region of the quality of the foundation material as in the blowout failure erosion images in Fig. B.10 and Fig. B.11. 5. Fig. B.20. DWR Final Construction Report FCR 65-09. Critical Design Flaw linked to blowout failure. DWR reveals that the spillway foundation will include anchor bars emplaced in "clay seams". This evidences that DWR was allowing the slab design to have anchor bars to function from the "worst foundation available". This would include poor foundation materials such areas of clay and areas of soil-like highly erodible extensively weathered rock. The blowout failure area reveals this type of material (poor foundation materials). This evidences the non-ability of the anchor bars to maintain the integrity of anchorage in these clay and soil-like foundation materials. These materials are highly erodible in subsurface slab water flow. Scouring erosion would remove these seams of materials rendering a significant loss of pounds per square inch in anchorage strength of the anchor bars. 6. Figs. B.14 and B.15. Extensive corrosion of rebar at slab drain line cracks weakened the slab into a severely degraded structural condition (little to no remaining tensile strength. Reference "Slab Structural Degradation from Rebar Corrosion at Cracks". 7. Fig. B.10. "Loss of Anchorage". Evidence of little to no ground anchorage at the blow out failure area involving 60+ anchor bars in 3 main blowout failure slabs. 8. Figs. B.8 and B.7. Multi-slab long drain line slab fracture 5.3 feet from the originating failure "hole". Construction Design Flaw of emplacing drains within the slab, thus "thinning" the slab thickness resulted in chronic slab cracking over drain lines for the entire 3000+ feet of the spillway. Three rows of slab wide drain line cracks were in the initial blowout failure slab where the failure "hole" was identified. The first drain line crack "row" was 5.3 feet from the slab "hole". 9   9. Stagnation Pressure in combination with hydrostatic forces fractured the slab from the seam "hole" to the nearest slab drain line downslope. Pressure force analysis: A high velocity flow near 90 feet per second, at 54,500 cubic feet per second, produces extreme uplift forces from a small offset in the slab joint alignment from Stagnation Pressure. Whether the slab alignment is offset positive or negative, these extreme forces at the high velocity flow are significant and could easily fracture a highly structurally weakened slab. Reference - U.S. Bureau of Reclamation Stagnation Pressure Mean Uplift Pressure Plot [14], with an Initiating Failure point referenced to a flow velocity at or near 90 feet per second (near Station 33+00). A half-inch offset of an upslope slab joint induces an 86.3 feet of water in uplift pressure underneath the slab. This translates to 37.4 pounds per square inch in uplift given an amount of flow to some drainage. Applying this force to a 40 foot long seam would yield uplift pressures of 53.8 tons in a simple example square footage affecting a 40 foot x 6 inch under-slab area (note: effective seam gap of 0.125 inches). 10. This First major fracture blowout failure started with the sudden collapse and/or lifting of a 5.3 foot section of the slab. This created a large hole for the high velocity 90 feet per second, 54,500 cubic feet per second, flow to penetrate under the next 20 foot slab section - along the next drain line crack - of the slab and fracturing and lifting away of the slab. The next section was to the to this next cracked drain line region, then the remaining section to the downslope seam. 11. The extreme hydraulic turbulent forces and erosion development, generated from this initial slab blowout, developed laterally and downslope in continuing to fracture and lift away adjacent slabs. The initial blowout failure dimensions, of affected slabs, determined by the strength of the anchor bars from the foundation material. Poor foundation material resulted in full lifting-removal of 9 slabs with the partial destruction of 4 additional slabs. 12. Subsequent spillway operation of higher volume flows continued the lateral, upslope and downslope destruction of the spillway. Organizational Root Causes2 The Oroville Dam Gated Spillway failure – self-destruction was preventable. Over decades, there were many opportunities for DWR, DSOD, and FERC to recognize and investigate serious issues that could have led to effective remedial measures. Evidence documented in this Forensic Root Causes Analysis reveals the significant extent in decades of opportunities for DWR Engineering and Maintenance, DSOD, and FERC to detect and investigate severe anomalies. The lack of recognition of the significance of the severe issues revealed in this report, from the beginning of the construction of the spillway to present, reveals the systematic failure of these organizations to identify and rectify critical components of the Oroville Dam Gated Spillway to                                                                                                                 2  DWR-­‐  DOSD  and  FERC  inspection,  maintenance  and  repair  document  evidence  of  Human  and   Organizational  Factor  Root  Causes  is  summarized  in   https://drive.google.com/open?id=0Bz1I1mIutSEnNG1Vem9lYlFFcjA     10   the required level of the required Operating “Standard of Care” and thereby violating the First Principle of Civil Law [20]: “imposing risks on people if and only if it is reasonable to assume they have consented to those risks.” The breakup failure of Oroville's Main Spillway was the direct result of DWR, DOSD, and FERC decisions, actions, non-actions, and lack of "combined functional competency".3 The spillway was destroying itself from within from each flood control spill operation (erosive foundation degradation, anchorage degradation) and the progression of aging (corrosion) in the flawed drain design in chronic cracking in the slabs. This was an Organizational and Regulated Failure. Perhaps the greatest failure was the deficiency of insuring the operational structural integrity, and the spillway's ultimate Safety and Reliability based on inspections and analyses of inspection results performed by DWR, DSOD, and FERC. This Root Causes investigation indicates that one of the critically important issues was the persistent inability of these responsible and accountable organizations to determine ‘accurately’ what was ‘Safe’ and ‘Fit-For-Purpose.’ The available DWR – DSOD and FERC spillway Inspection, Maintenance, and Repair documentation contain repeated references to spillway components that were thought to be ‘Safe’ and ‘Fit-For-Purpose’ when no ‘proof’ was provided to validate and substantiate those critically important conclusions.4 The failure of DWR Engineering, and Operations & Maintenance which allowed thousands of feet of drains to become inoperable; documented non-functional by photographs, noted "drain repair" in construction bids, and contract awards. Yet, the thousands of feet of inoperable spillway drains, in critical "steep slope" sections of the spillway's pre-blowout failure area, remained for years, even though DWR’s original Spillway Design documentation specifically required (Report Section D. Spillway, page D-25): ”The areas of maintenance to be checked include a yearly inspection of the under drains to see they have not plugged.”5 Given the evidence of the findings in this report, the Oroville Spillway was destroying itself over time until the weakest section would finally give way. This engineering situation was completely preventable. Recognition, Remedial Action, Correction, and the ultimate restoration of the spillway's structural integrity should have resulted many decades ago, especially when U.S. Bureau of Reclamation was warning dam owners of the dangers of sub-slab voiding and penetrating water flow risking the powerful Stagnation Pressure failure modes [14].                                                                                                                 3  Summary  of  documentation  cited  available  at  -­‐   https://drive.google.com/open?id=0Bz1I1mIutSEnWDRhODdRM3RLM1k     4  Background  on  What  is  Safe?  and  How  Safe  is  Safe?  available  at  -­‐   https://drive.google.com/open?id=0Bz1I1mIutSEnbUgwUXZ6WXlYMmc   https://drive.google.com/open?id=0Bz1I1mIutSEnUkpQcXRGQklDbHM     5 Department of Water Resources (1967): Design Engineer’s Criteria for Operation and Maintenance, State Water Facilities, Oroville Division, Oroville Dam and Reservoir, Oroville, California.   11   Fig. B.1. Comparison of 1969 and 2017 photographs reveals a significant underflow development underneath the spillway over time. Original Construction Defects, Flaws, and Maintenance contributed to the formation of a high volume channel system underneath the spillway concrete chute.   .   12   Fig. B.2. January 27, 2017 Pre-blowout failure photograph of 7.9 foot by 14 inch "hole" in the concrete slab in Oroville Spillway (circled). Note the non-functioning sidewall drains (circled). 13   Fig. B.3. Forensic Photographic precision alignment of three photographs confirms the BOC assessment of the origin of the spillway blowout failure from a "hole", including subsequent slab(s) destruction and erosion. Contributing base photograph [6]. 14   Fig. B.4. Non-Functioning Sidewall drain revealed in a Nov 9, 2007 spillway photograph (red arrow). Minor seepage reveals working sidewall drains (stains on sidewalls). Photograph - source [8]. 15   Fig. B.5. Clues to history of 1,780 linear feet of clogged drains, the two affected areas, and where the seepage reveals water "diving" under "void fill areas."   16   Fig. B.6. Evidence of Spontaneous Stress Induced Spalling of concrete at slab seams. The depth of the spalling "hole" reveals to a level to the upper rebar. This spalling of "holes" matches photographic evidence of a larger 7.9 foot by 14 inch "hole" found to be at the location of the initial blowout failure. 17   Fig. B.7. Construction Design Flaw of emplacing drains within the slab, thus "thinning" the slab thickness resulted in chronic slab cracking over drain lines for the entire 3000+ feet of the spillway. Three rows of slab wide drain line cracks were in the initial blowout failure slab where the failure "hole" was identified. The first drain line crack "row" was 5.3 feet from the slab "hole". 18   Fig. B.8. Initial failure "hole" defect. Initiation point of the Initial Blowout Failure Area of slabs along this extensively repaired spillway seam. Hole dimension measured with forensic high resolution photographs to be near 7.9 feet along the seam by 14 inches downslope from the seam. White lines denote the drain line cracks in the slab surface. The depth of the "hole" is inferred to be many inches deep to the upper layer of rebar - as evidenced in prior spalling spontaneous defect occurrences revealed in Fig. B.6. Also noted by the Board of Consultants Memorandum No. 2 (depth to rebar layer), page 8 [3]. 19   Fig. B.9. Forensic Photographic of initiation failure "hole" at an upslope slab seam. Dimensions in a high-resolution zoom determined to be at or near 7.9 feet by 14 inches. This "hole" is located at a seam that has had extensive concrete patch, cuts, and repairs in maintenance work. Indicative of a structural "problem area" (see Fig. B.8). 20   Fig. B.10. Initiating Failure Hole location reveals a deep seam of highly erodible foundation material (incompetent rock) that is many feet deeper than the grouted 5 foot deep slab anchor bars. Angle of seam inferred by dashed line. Image reveals the nature of why the "hole" location and the full 178 foot wide seam area was a structural problem area. The upslope "soil-like" foundation material is in a transition zone between the incompetent rock and the competent rock (downslope from the dashed line). Thus, the "communicating" slab forces through the load transfer bars would have experienced a differential in structural integrity or stability. 21   Fig. B.11. Blowout Failure slabs located at a transition zone of higher integrity anchorage stability slabs verses slabs emplaced on poor anchorage stability based slabs above "soil-like" erodible foundation material (incompetent rock). 22   Fig. B.12. U.S. Bureau of Reclamation Stagnation Pressure Mean Uplift Pressure Plot [14]. Initiating Failure point referenced to a flow velocity at or near 90 feet per second (near Station 33+00). A half inch offset of an upslope slab joint induces an 86.3 feet of water in uplift pressure underneath the slab. This translates to 37.4 pounds per square inch in uplift given an amount of flow to some drainage. Applying this force to a 40 foot long seam could yield uplift pressures of 53.8 tons in a simple example square footage affecting a 40 foot x 6 inch under-slab area (note: effective seam gap of 0.125 inches). This exemplifies the importance of "sealing" slab joints with modern day "water stops" to prevent this dangerous spillway breakup failure mode. 23   Fig. B.13. U.S. Bureau of Reclamation Unit Discharge water flow into a seam with an offset [14]. Initiating Failure point referenced to a flow velocity at or near 90 feet per second (near Station 33+00). A half inch offset of an upslope slab joint has the ability to induce a sub slab flow of 13.84 cubic feet per second for the width of two slabs in the initial blowout failure seam (0.125 effective seam gap with 1/2 inch seam offset). This is a significant volume of pressurized sub-slab water flow that has the ability to aggressively erode soil-like foundation material. This pressurized sub-slab water flow could "scour" the foundation creating "channels" and "large voids" underneath the spillway. 24   Fig. B.14. Evidence of extensive corrosion of rebar (circles) from slab penetrating water through cracks in the slab above drain lines. Any corrosion of the rebar above these chronic deep slab cracks in the drain line "thinning zones" creates a slab structural failure risk or collapse. This photograph is from a multi-slab breakage along a full drain line where the fracture is from the center of the spillway to the sidewall (near 90 feet). The fracture is centered above a drain line (See Fig. B.7). With the evidence of extensive corrosion of the rebar above this pre-cracked slab above the drain line, this combination forms the ideal failure weak zone in the spillway (near total loss of tensile strength and the concrete is already cracked from the thinning of the drain line). Thus the structural integrity of the slab becomes highly dependent on a solid foundation and also dependent upon the structural integrity of the distributed anchor bars. 25   Fig. B.15. Further Evidence of extensive corrosion of rebar in the spillway (circles). The corrosion is so extensive that the saw cut in the concrete left the granular remains of the rebar as an "orange" discoloration as "rust" remains. The elongated orange color stain is the remains of a transverse section of rebar. This "saw cut" examination hole is located next to a drain line in the slab. Construction workers were examining the state of the Upper Spillway near the under slab drain lines (drain pipe below & cut out in this image zoom view). 26   Fig. B.16. DWR Official Final Geology Report Spec 65-09 specifies that the Spillway slabs were built upon a layer of "compacted clayey fines". Original drawing number IF262 detail is enhanced for readability as the original is faded. This drawing conflicts with the HYD-510 spec that the slab be emplaced fully upon a continuous seam of rock (or backfill concrete in subgrade areas). Note: This report is not publicly available. This base image is from the report to reveal that the foundation of the spillway had a highly erodible layer of clay built into the design. This is a design flaw that reveals how the "progression" of voiding, piping, and high volume of under-slab water flow developed over time. Not shown in this drawing is up to the 45 deep layer areas (full blowout failure region) of erodible soil-like material (clay-clayey and highly erodible rock) to where large voids could form beneath the spillway in time. 27   Fig. B.17. Dispute arose between original specifications intended to excavate the spillway to strong fresh rock or strong weathered rock. Specification stated: "Excavation for the chute shall be to fresh or moderately weathered rock that cannot be further removed by heavy duty power excavating equipment." DWR Field Engineer intervened and directed the contractor to only "excavate to the grades shown on the drawings". The contractor was following specifications to where any poor foundation material would be backfilled with concrete to "grade level". This report statement infers that DWR believed the contractor was using this specification in a desire for the additional pay of $30 per cubic yard of concrete in backfill work. This DWR Field Engineer intervention "orders", in contrast to the accuracy of the "specifications" in excavation, is evidence that a financial decision was a basis to not excavate to strong competent rock. If this "intervention" by DWR Field Engineer had not occurred, it may be possible that the large seams of highly erodible soil-like foundation material would have been fully repaired to competent backfill of concrete. The DWR Field Engineer's "intervention" evidences that a serious flaw was introduced that was a primary cause for the instability and the subsequent "blowout failure". 28   Fig. B.18. DWR Final Construction Report Photo No 4632, noting "Chute foundation in vicinity of Sta. 27+75, 20'L. Compacted, clayey fines cover most of the rock." Photograph confirms construction technique identified in DWR Final Geological Report Spec 65-09 where a "compacted clayey fines" layer was identified as a fill layer under the slab to facilitate irregular base rock or irregular highly weathered rock surfaces (see Fig. B.16). 29   Fig. B.19. DWR Final Construction Report Photo No 4632, Pre-emplaced drain lines with gravel next to the pipes. Note the width area of the gravel. This forms a wide "tent" when covered in polyethylene plastic. This wide tent area weakens the slab as this area is non-structural. Note the "wavy" emplacement of the drain lines. This evidences the match to the "wavy" cracking observed in the spillway as the cracks are following the original emplacement. 30   Fig. B.20. DWR Final Construction Report FCR 65-09. Critical Design Flaw linked to blowout failure. DWR reveals that the spillway foundation will include anchor bars emplaced in "clay seams". This evidences that DWR was allowing the slab design to have anchor bars to function from the "worst foundation available". This would include poor foundation materials such areas of clay and areas of soil-like highly erodible extensively weathered rock. The blowout failure area reveals this type of material (poor foundation materials). This evidences the non-ability of the anchor bars to maintain the integrity of anchorage in these clay and soil-like foundation materials. These materials are highly erodible in subsurface slab water flow. Scouring erosion would remove these seams of materials rendering a significant loss of pounds per square inch in anchorage strength of the anchor bars. 31   Fig. B.21. DWR Final Geology Report Spec 65-09 denotes the foundation geology of the subgrade quality of foundation material that the invert concrete chute was constructed upon. The Seam (marked as a series of "S"'s) follows the dashed line seam in Fig. B.10. This drawing reveals the same foundation structural integrity transition region of the quality of the foundation material as in the blowout failure erosion images in Fig. B.10 and Fig. B.11. This geologic report drawing identifies that DWR was aware of the type of foundation material at this future blowout location. DWR BOC report Memorandum No. 1 notes that "Compacted clay is also a term sometimes used to describe highly weathered rock." 32   References: [1] Bea,  R.  G.  (2017a):  Preliminary  Root  Causes  Analysis  of  the  Failures  of  the  Oroville  Dam   Gated  Spillway,  Center  for  Catastrophic  Risk  Management,  University  of  California  Berkeley,   April  17,  available  at   https://drive.google.com/open?id=0Bz1I1mIutSEnSUY5WjluQmhPXzg   [2] The Great New Year's Flood of 1997 in Northern California - DWR 162,500 cubic feet per second & 112,500 cubic feet per second spillway flows, page 9 http://cepsym.org/Sympro1997/Roos.pdf [3] Ref21 - FailureHoleUpliftForceJPG - March 17, 2017 BOC Memorandum No. 2, sections redacted, reference file BOC Memo 2_031717.pdf Report available at https://drive.google.com/open?id=0Bz1I1mIutSEnWXB4NVNRVUhsR1U [4] Ref 22 - BOCwaterflowExtraordinaryLargeJPG - March 10, 2017 BOC Memorandum No. 1, FERC document 20170317-5113 Report  available  at  https://drive.google.com/open?id=0Bz1I1mIutSEnOXdGMU1Ob0JGcFE [5] Something was wrong with the Oroville Dam spillway weeks before the Department of Water Resources noticed a hole in the concrete. http://www.thereporter.com/article/NG/20170311/NEWS/170319973 [6] MetaBunk - Contributing photograph - https://www.metabunk.org/oroville-dam-spillwayfailure.t8381/page-25  post  #963 [7] DWR Notice To Contractors: Sealed Bid request for Spillway repairs 2009 http://www.water.ca.gov/engineering/Contracts/09-14_Notice.pdf https://drive.google.com/open?id=0Bz1I1mIutSEnRENxdmJHM3ZWMHM [8] MetaBunk - Nov 9, 2007 non-functioning spillway sidewall drain photograph https://www.metabunk.org/oroville-dam-spillway-failure.t8381/page-24 post #960 [9] Forensic Team Memorandum - Initial findings - http://www.water.ca.gov/orovillespillway/pdf/2017/Memorandum_050517.pdf Report  available  at  https://drive.google.com/open?id=0B0_jjqbhy5meVEpjR1RlZExBR1E [10] Johnson, T. (2017): Evidence of 9+ foot thick Large Block of concrete at the bottom of Main Spillway? Large Void Chasms under Spillway? DSOD Inspectors told not to fix until damaged? - Figures – Tony Johnson Report8 - Combined reports 1 - 10 available at: https://drive.google.com/open?id=0Bz1I1mIutSEnR3U4QVY2TFRWLWc [11] DWR bid Award for 2009 Spillway repairs - Line item 2 - 240 LF of drain repair identified by DWR engineer - 09-14_Summary.pdf http://www.water.ca.gov/engineering/Contracts/0914_Summary.pdf https://drive.google.com/open?id=0Bz1I1mIutSEnR28tWDQ3enpjZmM 33   [12] State of California The Resources Agency, Department of Water Resources, Division of Design and Construction, FINAL GEOLOGICAL REPORT OROVILLE DAM SPILLWAY, Appendix A to Final Construction Report, Contract No. 354284, Specification No. 65-09, Project Geology Report C-38, March 1970, "Oroville Dam Spillway - Final Geology Report Spec 65-09 - March 1970_Part1 &2.pdf" [13] State of California The Resources Agency, Department of Water Resources, Division of Design and Construction, Oroville, California, Final Construction Report On Oroville Dam Spillway March 1968, "Oroville Spillway Final Construction Report - FCR 65-09_Part1 26.pdf" [14] U.S. Bureau of Reclamation, Stagnation Pressure Failure of Spillway Chutes, V1-1, June 2015 - https://drive.google.com/open?id=0Bz1I1mIutSEndEt5azlHUC1yM2s Hydroworld - Predicting Spillway Failure - USBR plot data from laboratory testing http://www.hydroworld.com/articles/hr/print/volume-­‐29/issue-­‐7/articles/predicting-­‐ spillway-­‐failure.html     [15] U.S.  Department  of  the  Interior  Bureau  of  Reclamation  (1965):  Hydraulic  Model   Studies  of  the  Flood  Control  Outlet  and  Spillway  for  Oroville  Dam,  California  Department  of   Water  Resources,  State  of  California,  Report  No.  Hyd-­‐510,  Figure 93, Detail A, Drawing Number A-3B9-4, Slab drawings marking denote slab emplaced upon rock. https://www.usbr.gov/tsc/techreferences/hydraulics_lab/pubs/HYD/HYD-510.pdf   https://drive.google.com/open?id=0Bz1I1mIutSEnQXFWRmxnc0dYOXM     Department  of  Water  Resources  (1974):  California  State  Water  Project,  Volume  III,  Storage   Facilities,  Bulletin  Number  200,   https://archive.org/details/zh9californiastatew2003calirich   https://drive.google.com/open?id=0Bz1I1mIutSEnR1VIcHp2amZjbU0   Department  of  Water  Resources  (1967):  Design  Engineer’s  Criteria  for  Operation  and   Maintenance,  State  Water  Facilities,  Oroville  Division,  Oroville  Dam  and  Reservoir,  Oroville,   California.   [16] Johnson, T. (2017): Did Oroville Spillway Break Apart From Design Flaws? Or Poorly understood Stagnation Pressure back in the 1960's? – Tony Johnson Report5 - Combined reports 1 - 10 available at: https://drive.google.com/open?id=0Bz1I1mIutSEnR3U4QVY2TFRWLWc [17] Johnson, T. (2017): Evidence of 9+ foot thick Large Block of concrete at the bottom of Main Spillway? Large Void Chasms under Spillway? DSOD Inspectors told not to fix until damaged? – Tony Johnson Report 8 - Combined reports 1 - 10 available at: https://drive.google.com/open?id=0Bz1I1mIutSEnR3U4QVY2TFRWLWc 34   [18] Johnson, T. (2017): Could DWR forfeit the FEMA & CA customer's $500 million in Spillway repair funding? Will DWR be found Legally Liable in deep void filling? Hid deep voiding from FERC? Who will pay the bills? – Tony Johnson Report 9 - Combined reports 1 10 available at: https://drive.google.com/open?id=0Bz1I1mIutSEnR3U4QVY2TFRWLWc [19] Oroville Spillway Situation: Fast facts and timeline - KRCRTV http://www.krcrtv.com/news/local/butte/oroville-dam-situation-fast-facts-andtimeline/335429419th [20]  Bea,  R.G.  (2011):  An  Instrument  of  Risk  Management:  The  Law,  Department  of  Civil  &   Environmental  Engineering,  University    of  California  Berkeley,  available  at:   https://drive.google.com/open?id=0B0_jjqbhy5meeGV3dENsSHpLQzg     35