Playing domino and cards in one game of chance

With the trending #MeToo topic, several famous actors have been accused of, let’s phrase it politely, ‘not performing up to expectations’. Large, multi-season productions have come to a complete grinding halt with their leading actor or producer being put out of action by the accusations. So, by failing of one single key component, the entire organization (production, marketing, other actors, behind-the-scene-logistics and all other aspects of a major TV production) has collapsed – like a house of cards.

So, now back to our usual topic: crisis management. Most crisis organizations have been built resiliently. Just because – well, during a crisis it can be expected that certain factors fail to perform – it’s a crisis, remember? So, we can still perform our crisis mitigating job with one failing component. But what if these components start to fall like domino bricks? One failing component triggering the failure of the next? And the next… A doomsday scenario? Maybe. Worst case? For sure. But unfortunately, not as farfetched as we’d hoped for.

What if an organization meets all official requirements and complies with all regulations… on paper. But when you start to look more closely at the individual mitigating measures taken, you get an uneasy feeling – something is missing, but it’s not immediately obvious what. After a more thorough study of the contingency plans the uneasy feeling grows. To ease the feeling, you start asking some – very simple – questions to the onsite personnel. Funny enough, the answers are not coming. Or worse – the answer is “I don’t know” or “No, we don’t have that” or even more frightening: “Eh, now that you ask … We’ve never really thought about it like that…

When looking closer, it turns out that in many organizations some of the major and very basic safety features are virtually non-existent in reality. On paper, everything is of course accounted for, but in reality, things just aren’t there or predictably won’t work. Some examples of combinations of factors we find during our line of work:

  • Missing of an effective early suppression system, allowing especially spill fires to develop before the first attack with foam and no functional cooling system. Yes, it’s there, but manually operated and there’s no people allowed on the premises when there’s a fire alarm.
  • Lacking capacity and knowledge of industrial firefighting within the municipal fire brigade in an otherwise urban area.
  • A single muster point which happens to be down wind of the premises considering the prevailing winds.
  • Following internal procedures, multiple simultaneous tasks for the site manager at several different locations.
  • No means of communication across the premises other than two VHF radio channels which are only available to a very limited number of persons.
  • No readily available access to data concerning who’s on the site and who’s working where.
  • A combination of an electronic and hand-written access control systems to unmanned parts of the premises, tracking only the driver of an arriving vehicle, but not it’s passengers.
  • No automated fire detection system outside, only inside the structures.

So, here’s a fictitious, but unfortunately very realistic, scenario:

We have a liquid spill: 2000m3 of highly flammable liquid pouring from a single tank out of a faulty flange[1] into a tank bund. No way to block-bleed-block[2]. Either the pool of liquid ignites immediately, or the vapors find an ignition source in the local furnaces some time later– we have no means of preventing ignition nor leak detection. The fire is detected by an eyewitness (as there are no detection systems for this type of fire), so we manually sound the alarm. The 100+ contractors on site (nobody knows exactly how much as some are registered electronically and some on paper) do as instructed and move directly into the smoke, heat and toxic gasses on their way to the single downwind muster station. The site manager, according to procedure abandoning his control room, goes outside to make contact with the fire brigade at the predesignated meeting point 200m outside the gates and starts the command & control procedure with the fire chief. The control room is now manned with just 2 operators who have no influence over the spilling liquid. Besides a first aider, no first responders are on site. Headcount does not take place as the person responsible for doing that is talking to the fire brigade, 200 meters further down the road, and the data from the digital muster system is unavailable to both him and the control room. Sensible contractors don’t move into the smoke, so on their own initiative they go elsewhere, without a means to communicate to the control room. By the time the municipal fire brigade is ready to start foaming the spill, the fire has had 30 minutes of undisturbed developing time (remember, the cooling system is manually and locally operated – no one allowed on site when it’s on fire) so the fire brigade stays at a safe distance: radiation heat range of the fire exceeding the effective distance of their foam monitors.

Now we have:

  1. A) 100+ people on the run – no one knows where they are: run off, mustered or still on the premises?
  2. B) a well-developed blazing industrial fire without fixed systems to suppress it and a fire brigade who’s used to and equipped for extinguishing car fires, houses and waste paper containers
  3. C) a catastrophic fire potential from all the hydrocarbons stored on site
  4. D) a collapsed internal command & control system
  5. E) all kinds of neighboring structures, both urban and industrial, all within the range of influence from the incident.

If there’s ever a flange which starts to leak, all of the above is going to happen. And nothing to stop it…

So, in this example, there’s not just one key component failing, but the entire chain of components will fail like a row of domino bricks. The entire – on paper and in license to operate undoubtedly exquisitely detailed – emergency organization is not going to ‘perform up to expectations’ and will crumble like a house of cards. Starting in minute 1, exactly following the procedure.

The clue is getting the early suppression systems and information management in working order, not just on paper. Kill the monster when it’s small. We can’t afford Godzilla featuring in an episode of house of cards …


[1] Undoubtedly, the chance of such an occurrence is once every 200.000 years or so according to the safety case, hence no (real) corrective measures were necessary. So, even if the effect is potentially catastrophic, Chance X Effect is considered acceptably low. But we’ve been doing periodic maintenance on the dozens of flanges during the years. And people do make mistakes, don’t they…?

[2] Block-bleed-block: a way to isolate a structure from two sides and drain the contents in the middle, in this case to attempt getting rid of the liquid fueling the flames.

One thought on “‘House of Cards’

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.