accident investigation workbook presenting

1NPC/20365/142_Accident Investigation Workbook.ppt© Arthur D. Little Limited

Effective Accident Investigationfor the Process Industries

WORKBOOKJune 2005


Introduction - Venue Arrangements

Fire Alarm, Test and Evacuation

Welfare Facilities

Breaks and Refreshments

Messages and Mobile Phones


Introduction - Objectives

This five-day accident investigation training course has eight primary units and includes some NPC specific elements:

Understanding the purpose of accident investigation

Introduction to four basic investigation tools/models

Evidence gathering

Understanding human factors

Understanding the different needs of various stakeholders involved in the accident investigation process

Writing the report

Emergency Management Planning

Key learning points from past Major Accidents

NPA Case Materials – One additional accident reporting case study– Additional case study on Emergency Response Planning


Introduction - Objectives

This training course has not been developed as a specific accident investigation procedure, but to provide an introduction to tools and techniques that will facilitate effective accident investigation

The four basic investigation tools/models provide a framework around which to structure and undertake the investigation

The section on evidence is structured around the types of evidence that should be considered and the priority in which evidence should be gathered. It does not specify how evidence should be collected, analysed and recorded

Human factors is becoming a much more important part of accident investigation and third party company prosecution. This training course provides a brief introduction to Human Factors and various techniques for analysing personnel behaviour

Emergency Management Planning focuses on various key aspects of emergency planning and response management based upon industry best practice and lessons learnt from past accidents


Introduction

This training course is one of a number of services provided internationally to the process industries

Arthur D. Little provides a range of safety and environmental services to high hazard industries internationally, including oil and gas processing, oil and gas exploration and transportation, and passenger and freight transportation

Our safety and environmental services include:– Independent auditing– Risk assessment– Due diligence– Accident investigation– Independent assessment– Management training– Management system development

This training course is based on our training course for rail accident investigators and is tutored by process industry safety experts


Introduction

What I need from this Effective Accident Investigation training course is:


Introduction

The overall structure of the training course:

Day 2Briefing -Evidence

Gathering Part 1

ADL Case Study Part 1b

Briefing -Evidence

Gathering Part 2

ADL Case Study Part 2

Briefing -Introduction to

HumanFactors

ADL Case Study Part 1a

Day 3Individual Case

Study 2Briefing -Interface

Management

Day 1Briefing – Why

investigateaccidents?

Briefing – The Investigation

Process

Video – Piper Alpha ‘Spiral to

Disaster’

Briefing - Tools and

TechniquesIntroduction Individual Case

Study 1

Day 4Briefing –

Write-up andPresentation



Summary of Day 3

Individual Case Study 3

Review of ADL Case Study & Conclusions

Day 5 Test

Summary of Day 1

Summary of Day 2

Briefing –Introduction to Safety Culture

Briefing –Emergency

Management Planning


Review of Past Major

Accidents

Revision of Key Course

Learning Points

Review of NPC Investigation

Reports

Review of NPC Emergency Response

Manual


Time Session

08.30 Welcome and Introduction

09.00 Briefing - Why Investigate Accidents?

10.00 BREAK

10.30 Briefing - The Investigation Process

11.30 Video – Piper Alpha ‘Spiral to Disaster’

12.00 LUNCH

13.30 Briefing and Class Exercise – Tools and Techniques

15.00 BREAK

15.30 Briefing and Class Exercise – Tools and Techniques

16.00 Individual Case Study 1

17.00 END OF DAY 1

Introduction - Timetable

The time-table for Day 1 is:


Time Session

08.30 Review of Day 1

09.00 ADL Case Study Part 1a

10.00 BREAK

10.30 Briefing – Evidence Gathering Part 1

11.00 ADL Case Study Part 1b

12.00 LUNCH

13.30 Briefing – Evidence Gathering Part 2

15.00 BREAK

15.30 ADL Case Study Part 2

17.00 END OF DAY 2






Time Session


09.00 Briefing – Introduction to Human Factors

10.00 BREAK

10.30 Briefing – Introduction to Safety Culture

11.15 Briefing – Interface Management

12.00 LUNCH


14.15 Briefing – Emergency Management Planning

15.00 BREAK

15.30 Briefing – Emergency Management Planning

16.15 ADL Case Study Part 3

17.00 END OF DAY 3




Time Session


09.00 Briefing – Write-up and Presentation

10.00 BREAK


11.00 ADL Case Study Part 4a

12.00 LUNCH

13.30 ADL Case Study Part 4b

15.00 BREAK

15.30 Review of ADL Case Study and Conclusions

17.00 END OF DAY 4




Time Session

08.30 Review of NPC Investigation Reports

10.00 BREAK

10.30 Review of NPC Emergency Response Manual

12.00 LUNCH

13.30 Revision of Key Course Learning Points

14.15 Review of Major Past Accidents

15.00 BREAK

15.30 Test

17.00 CLOSE


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing – Why Investigate Accidents?

The factors for and against improved safety

Accident producing factorsCreeping EntropyMurphy’s LawNormalisationRoutinisationIntrinsic Hazards

Continuing efforts to improve safety performanceImproved DefencesAccident Investigation/ReportingEnhanced Safety ManagementUnsafe Act AuditingSafety Management Systems etc.

AccidentFrequency

Time

FOR

AGAINST


Briefing – Why Investigate Accidents?

The factors against improved safety – defined

Creeping entropy: No system or organisation remains static. Its components gradually wear out and variability increases. People begin to take each other for granted

Murphy’s Law: No matter how well defended the system, or how remote the hazards, someone will find a way of defeating the protective measures. If something can go wrong, it will go wrong

Normalisation: This describes the process of forgetting to be afraid. People exposed to fairly fixed and known risks over lengthy periods of time come to under-estimate them

Routinisation: Activities within a well-established system become routine. At an individual level, this means that people become skilled and practised at their jobs. The ability to perform recurrent tasks, more or less automatically, liberates conscious attention for other matters. However, this, in turn, can lead to its capture by things unrelated to the task in hand. Habit is thus a mixed blessing. Limited attention capacity is released for more strategic concerns, but the person is also rendered more susceptible to absent-minded slips and lapses. Such errors are the hallmark of the practised performer

Intrinsic hazards: No matter how well defended the system, hazards do not disappear. They too are subject to unpredictable local variations


The need for effective accident investigation is driven by legal, economic and human considerations

Briefing - Why Investigate Accidents?

£

Need for EffectiveAccident Investigation

LEGAL ECONOMIC HUMAN



There is a legal requirement in many countries for organisations to investigate accidents - for example in the UK

Control of Major Accident

Hazards Regulations

Control of Major Accident

Hazards Regulations

Management ofHealth and

Safety at WorkRegulations

Management ofHealth and

Safety at WorkRegulations

The Reporting of Injuries, Diseases and

Dangerous OccurrencesRegulations

The Reporting of Injuries, Diseases and

Dangerous OccurrencesRegulations

Health and Safetyat Work etc. Act 1974

Health and Safetyat Work etc. Act 1974

Safety Cases

ABCCompany Standards

XYZ Company Standards etc

The Construction(Design &

Management) Regulations

The Construction(Design &

Management) Regulations



Major accidents have driven the development of national and international regulations

1974 Flixborough explosion (28 fatalities) – In UK Health and Safety at Work etc Act 1974

1976 Seveso dioxin release (700 major injuries) – European Union Seveso Directive that led in UK to Control of Industrial Major Accident Hazards (CIMAH) Regulations 1984

1985 Bhopal toxic gas release – revision to threshold inventory levels for methyl iso-cyanate

1988 Piper Alpha disaster (167 fatalities) – In UK Offshore Safety Case Regulations 1994

1999 Longford Gas Explosion (2 fatalities) – In Australia Major Hazard Facility Regulations



Recent research commissioned by the Health and Safety Executive in the UK shows that in many organisations accident investigation is not adequate

The research (Accident Investigation - The drivers, methods and outcomes, HSE 2001) involved interviews with 100 organisations across a range of sectors, following a telephone survey of 1500 organisations

Key findings include:– Failure to discriminate, or indeed understand, the distinction between immediate

and underlying causes– Organisations often overestimate the quality of their investigations– Lack of formal systems to ensure recommendations are acted upon– Lack of training in accident investigation



The potential impact of major accidents on the profit and loss of an organisation can be significant

Loss of Exxon profitsassociated with the Valdezaccident in Prince WilliamSound, Alaska 24.03.89

6

4

2

0

$ bn

1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993

Exxon's net profits



Accidents can significantly affect business performance and lead to action against individual Directors

Following the UK rail accident at Hatfield, the Railtrack share price collapsed and the UK Government intervened



Even a relatively small accident can have a significant impact on the profit and loss of an organisation

Vehicle impact with above ground

pipeline

Accident

Total IRR 3,000,000,000Total Costs

IRR 300,000,000

IRR 2, 700,000,000

Direct CostsRepair to VehicleRepair to Pipeline

Indirect CostsManagement TimeCompensation ClaimsIncreased Insurance CostsBusiness InterruptionLoss of Good Will

Using Health and Safety Executive research, the indirect cost of accidents are 6-10 times the direct costs



The knock on impact for revenue generation can be sizeable

How easily can your business generate this extra revenue?

Profit Margin

Revenue toCover Costs

Total Cost

IRR 60m

IRR 300,000,000

5%



There are human/ethical reasons to investigate accidents

Lessons from LongfordThings happened on that day that no one had seen at Longford before. A steel cylinder sprang a leak that let liquid hydrocarbon spill onto the ground. A dribble at first, but then,over the course of the morning it developed into a cascade … Ice formed on pipework that normally was too hot to touch. Pumps that never stopped, ceased flowing and refused to start. Storage tank liquid levels that were normally stable plummeted … I was in Control Room One when the first explosion ripped apart a 14-tonne steel vessel, 25 metres from where I was standing. It sent shards of steel, dust, debris and liquid hydrocarbon into the atmosphere (The Age, 30/9/99).

These are the words of an operator involved in the accident ESSO’s gas plant at Longford, Victoria on 25 September 1998, an accident which killed two men, injured eight others and cut Melbourne’s gas supply for two weeks.


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing – The Investigation Process (Type of Investigation)

A typical sequence for accidents and investigations

The decision on the need for a formal investigation should be primarily based on the potential accident consequences and the opportunity to learn lessons

AccidentAccident

Emergency Response

Emergency Response

Evidence GatheringEvidence Gathering

Immediate InvestigationImmediate

InvestigationFormal

InvestigationFormal

Investigation

ReportReportReportReport



The decision on the need for a formal investigation should be primarily based on the potential consequences and the opportunity to learn lessons

Potential consequences can be in the areas of safety, health, environmental impact, financial, business reputation and political

CONSIDER FORMAL

INVESTIGATION FORMAL

INVESTIGATION

ONLY IMMEDIATE

INVESTIGATION

CONSIDER FORMAL

INVESTIGATION

Low High

Potential Consequences

Other factors that might affect the need for a formal investigation

Criminal investigation

Safety regulator investigation

National/international media interest

Political interest

Other factors that might affect the need for a formal investigation

Criminal investigation

Safety regulator investigation

National/international media interest

Political interest

Opportunityto LearnLessons


Briefing - The Investigation Process (Type of Investigation)

What is a formal investigation?

Defined Terms of Reference

Defined Investigation Team and Leader

Sufficient independence from line management

Access to people and resources to enable effective investigation

Production of a well-structured report

Review to ensure Terms of Reference are achieved

Formal Investigation – Key Characteristics


Some petroleum companies use a semi quantitative process to determine the incident category and level of investigation required

Potential Severity People Asset/Production Environment Reputation

A Never

Heard of in

industry

B Has

occurred in

industry

C Has

occurred in NPC

D Occurs several times a year in

NPC

E Occurs several times a year at

this site

Analysis level

1 Slight injury First Aid or medical treatment

Slight Damage, no disruption to operation

Slight Effect Slight Impact (public awareness)

SUMMARY ANALYSIS

2 Minor injury LWA 4 days or less RWC

Minor Damage (<$1,000,000 / or brief disruption)

Minor Effect Limited Impact (local public media)

SUMMARY ANALYSIS

3 Major injury (LTA, PPD < 4 days)

Local Damage ($1-10,000,000)

Localised Effect

National Impact (extensive adverse media)

FORMAL INVESTIGATION

4 Single fatality Major Damage ($10-100,000,000 / partial operation loss)

Major Effect Regional Impact (extensive adverse media)


5 Multiple fatalities

Extensive Damage (>$100,000,000 / & substantial operation loss)

Massive Effect

International Impact (extensive adverse media)


LOW

MEDIUM

HIGH

INTOLERABLE

INCREASING PROBABILITY

INC

REA

SING

SEVERITY



Briefing - The Investigation Process (Principal Objectives)

There are four principal objectives of a formal investigation. The Manager commissioning the investigation sets the Terms of Reference so that these objectives can be met

The Manager commissioning the investigation shall agree the Terms of Reference with the investigation leader

Principal Objectives

To establish the facts

To determine the immediate causes of the accident

To determine the underlying causes of the accident

To develop robust recommendations

Terms ofReference



Good practice in setting the Terms of Reference

The Terms of Reference should state:The type of investigation being undertakenThe name of the investigation leaderThe names of the investigation teamThat the purpose is to establish the full facts, identify the immediate and underlying causes so as to permit identification of actions that would prevent, reduce the risk of, and/or mitigate the consequences of recurrence of the accident/incidentThe requirement to make relevant recommendations to prevent, or reduce the risk of recurrence of the accident/incident, and mitigate the consequences should a recurrence take placeTo whom such recommendations may be addressedThe timescales for commencement and completion of the investigation and for issue of the report

Terms ofReference



Before proceeding, we will further develop our understanding of immediate and underlying causes and then focus on analysis techniques that will allow us to uncover the underlying causes of an accident

Conclusions

Immediate Cause(s)?

UnderlyingCause(s)

?

Principal Objectives

To establish the facts

To determine the immediate cause(s) of the accident

To determine the underlying cause(s) of the accident

To develop robust recommendations


Before describing some of these causal analysis techniques it is important we understand the principles behind the terms immediate cause(s) and underlying cause(s)

Briefing - The Investigation Process (Immediate and Underlying Causes)

Immediate Causes

What?When?Who?

How?Where?

Underlying Causes Why?Why?

Why?

Why?

Accident

“The immediate cause(s) is an unsafe act or unsafe condition which causes an accident or incident”

“Underlying cause(s) are any factors which led to the immediate cause(s) of accidents or incidents, or resulted in such causes not being identified and mitigated”


Briefing - The Investigation Process (Active and Latent Failures)

Active and latent failures

An accident is the product of a long chain of events. Unsafe acts, active failures, are often seen as the most important part of the accident story. However, the story began much earlier and involved many different aspects of the organisation. The stage had already been set for the accident by the presence of latent failures. These are either human or technical failures that lie in wait within the system, often for long periods.

Unsafe acts are frequent, but only a few have bad consequences. It is very hard to predict in advance exactly which unsafe acts will lead to an accident, but latent failures can be revealed long before any accident occurs.

Source: Shell TRIPOD Manual


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing and Class Exercise – Tools and Techniques (Causal Analysis Techniques)

There are many causal analysis techniques that can be applied to accident investigation. A few of the more common types of technique are:

Analysis of events can be useful in identifying and understanding the events that culminated in the accident

Barrier/Defence identification and analysis is used to identify the failures which led to the accident

“Checklist” Analysis is helpful in exploring different aspects of the accident

Unstructured methods are used to link ideas, usually at the start of an investigation

Whatever the technique, the reason it is used is to determine - “How, what, when, where, who and why did it happen?”


Briefing and Class Exercise – Tools and Techniques (Analysis of Events)

Analysis of events can be useful in identifying and understanding the events that culminated in the accident

e.g. Events and Causal Factor Charting (Source US Dept of Energy)

Event 1 Event 2 Event 3

Condition

AccidentEvent

Condition

Root Causes

Condition

Causal Factor

Events Are activeIdeally should be stated using one noun and one active verbShould be quantified where possible e.g. ‘the worker fell 10m’Should indicate the date and time of event, when knownShould be part of the accident sequence and linked to the event or events and conditions immediately preceding it

ConditionsAre passive e.g. “low light illumination in the area”Describe states or circumstances rather than occurrencesAs practical should be quantifiedShould indicate date and time if practicable/applicableAre associated with the corresponding event

Root CausesAre determined after all the significant eventsand conditions have been determined

Causal FactorsAre reasons why condition existed for the event to occur

Why?

Why?

Why?

Why?

What?

When?Who?

How?Where?


Class Exercise: Using the information given below (typical of the information you would have at the time the investigation team arrives on site) to start the event and causal analysis technique

Briefing and Class Exercise – Tools and Techniques (Event and Causal Analysis - Example)

Determine just the events and how they are linked for the above accident

Note:Normally for this exercise the investigation team would use removable notes to depict the events and conditions that affected the events chronologically

Accident DescriptionThis accident occurred following an acid sampling procedure. At the moment all you have heard is:

“At approximately 22:30 a process operator collected a Work Instruction to take an acid sample from the Pump A circuit. When the sample valve on Pump B circuit was opened there was an acid leak. The process operator had to be taken to hospital with chemical burns.”

example


Briefing and Class Exercise – Tools and Techniques (Event and Causal Analysis)

Class Exercise:



Class Exercise: Potential Solution

Process operator collects Work

Instruction to take acid sample

Process operator collects Work

Instruction to take acid sample

Process operator opens sample

valve in B pump circuit



Acid LeakAcid LeakProcess operator taken to hospital

with chemical burns

Process operator taken to hospital

with chemical burns


Briefing and Class Exercise – Tools and Techniques (Events and Causal Analysis)

Class Exercise (continued): Revise the events and causal analysis chart using the additional information given below

Information obtained from an onsite visit and further research has revealed:

Process operator stated that he shut off Pump A locally and cancelled the local ‘pumpstop’ alarm

The process operator indicated it was difficult to read the Pump A/B labels because of poor lighting

It took over 1 hour for the injured process operator to reach the nearby hospital

Use the information above to start to update the information on your first suggested solution, and begin to determine what conditions contributed to the events



Class Exercise:




Lighting made

it difficult to Read A/B

labels

It took one hour to

reach local hospital

Process operator collects

Work Instruction to take acid

sample



Acid Leak

Process operator

takento hospital

withchemical

burns

Process operator shuts off Pump A locally

Process operator cancels

local alarm


Briefing and Class Exercise – Tools and Techniques (Events and Causal Analysis)

Class Exercise (continued): Continue to develop the events and causal analysis chart using the additional information given below

Information obtained following a review of the facts and conditions, documentary evidence and interviews indicated:

It was found that the Pump A/B labels were old, dirty and damaged

The process operator had been on holiday the week before and this was his first shift back

The process operator had not used this sample point for 6 months prior to the accident

The A and B pumps appear to be identical

The Rescue Team had used a mobile phone to call an ambulance directly, rather than using the dedicated radio to the ambulance control. The ambulance control did not realise the priority of the call or the specific location to attend. This delayed the ambulance arriving at the accident location



Class Exercise:




From this diagram, can you suggest what might be the underlying cause(s) of the accident?

Lighting made it

difficult to read A/B

labels

It took one hour to

reach local hospital

Process operator collects

Work Instruction to take acid

sample



Acid Leak

Process operator

takento hospital

withchemical

burns

Process operator

shuts off A pump

Process operator cancels

local alarm

Delay dueto use of mobile

phone by Rescue Team

A and B pumps appear

identical

Operator had been

on holiday week

before

A/B labels were old, dirty and damaged

Operator had not

used this sample

point for 6 months


Briefing and Class Exercise – Tools and Techniques (Barrier Analysis)

Barrier/Defence identification and analysis is used to identify the failures which led to the accident

TargetHazard Barrier

Hazards are energy sources, materials conditions, etc that have the potential to cause injury or loss

A barrier is any means used to control, preventor impede the hazard from reaching the target

A target is a person or object thata hazard may damage, injureor harm



A barrier is any means used to control, prevent or impede the hazard from reaching the target

Barrier Analysis addressesBarriers that were in place and how they performedBarriers that were in place but not usedBarriers that were not in place but requiredThe barrier(s) that, if present or strengthened, would prevent the same or a similar accident from occurring in the future

Two types of barriers exist:Physical Barriers and Management Barriers

Physical Barrierse.g.

ConduitsEquipment and Engineering DesignFencesGuard RailsMasonryProtective ClothingSafety DevicesShieldsWarning Devices

Management Barrierse.g.

Hazard AnalysisKnowledge/SkillsSupervisionTrainingWork PlanningWork Procedures

Manhole



The basic Barrier Analysis is completed in five steps (e.g. for a simple electrocution accident)

Step 1: Identify the hazard and the target. Record them at the top of the worksheet e.g. “electrical cable -hazard, man - target”

Step 2: Identify each barrier. Record in column one. e.g.”Engineering drawings showing position of cable"

Step 3: Identify how the barrier performed. (What was the barrier's purpose? Was the barrier in place or not in place? Did the barrier fail? Was the barrier used if it was in place?) Record in column two. ”Drawings were incomplete and did not identify cable"

Step 4: Identify and consider probable causes of the barrier failure. Record in column three. "Engineering drawings and construction specifications were not updated"

Step 5: Evaluate the consequences of the failure in this accident. Record evaluation in column four. "Existence of electrical cable unknown"

Hazard e.g. Electrical Cable

Target e.g. Man

Barriers? How did

each barrier perform?

Why did barrier fail?

How did each barrier

affect accident?

Engineering drawings showing

position of cable

Drawings were

incomplete and did not

identify cable

Engineering drawings and construction

specifications were not updated

Existence of electrical

cable unknown


Briefing and Class Exercise – Tools and Techniques (Barrier Analysis - Example)

Class Exercise: Using all the information given about the acid leak, brainstorm the likely barriers that were not in place, unused or failed


Briefing and Class Exercise – Tools and Techniques (Barrier Analysis - Example)

For the acid leak it is useful (although not essential) to consider two targets

Each barrier would then be analysed to determine how it performed during the accident

Acid

Acid Sampling

The Environment

Process Operator

Design of containment systemsMaintenance of containment systems

Work instructionLabelling of equipmentLocal pump alarmsOperator training and PPE



Barrier analysis, and accident causation sequences, form the basis of the Shell TRIPOD analysis

Fallible decisions

Latent failures

Preconditions

Unsafe acts

System defences

AccidentLimited windows

of accident

Causal sequence



The Shell TRIPOD technique looks at unsafe conditions and underlying causes

TRIPOD is concerned with strengthening safety management rather than treating “symptoms of unsafety”

TRIPOD research has established latent failures can be categorised into 11 General Failure Types:

– Hardware– Design– Maintenance Management– Procedures– Error-enforcing conditions– Housekeeping

– Incompatible goals– Commercialisation– Organisation– Training– Defences


The Change Analysis technique is a variation of the Barrier Analysis technique

Change is one of the most common contributing factors to unsafe conditions and major accidents

When a system is perturbed by change there is a greater potential for errors, loss of control, and incidents

Change can be sudden and dramatic, or gradual and difficult to detect.

Changes in incident causation can be singular or multiple (often the case), and invariably additive and synergistic in their effects



The Change Analysis technique is ideal for brainstorming what has changed since conditions were safe (or perceived as safe)

Change Analysis looks at a problem by analysing the deviation between what is expected and what actually happened. The Investigator asks what occurred to make the outcome of the task or activity different from all other times this task or activity was successfully completed

Change Analysis is a good technique to use whenever the cause of the condition are obscure, you do not know where to start, or you suspect a change may have contributed to the condition

Not recognising the compounding of change (e.g. a change made 5 years previously combined with a change made recently) is a potential shortcoming of Change Analysis

Not recognising the introduction of gradual change as compared with immediate change is also possible



Change analysis is ideal for brainstorming about what has changed since conditions were safe (or perceived as safe)

When to use:When cause is obscure. Especially useful in evaluating equipment failures. This technique may be adequate to determine root cause of a relatively simple condition

Advantages:Simple 6 step process

Disadvantages:Limited value because of the danger of accepting wrong “obvious” answer. A singular problem technique that can be used in support of a larger investigation. It is not thorough enough to determine all of the causes for more complex conditions as all root causes may not be identified



The six steps involved in Change Analysis are as follows:

Incident withundesirable

consequences

Incident withundesirable

consequences

CompareCompare

Comparable incidentwithout undesirable

consequences

Comparable incidentwithout undesirable

consequences

Set downdifferencesSet down

differences

Analyse differencesfor effect onundesirable

consequences

Analyse differencesfor effect onundesirable

consequences

Integrate informationrelevant to the causes

of the undesirableconsequences

Integrate informationrelevant to the causes

of the undesirableconsequences

1

2

3

4

5

6

Change Analysis



The six steps involved in Change Analysis are as follows:

1. Describe the activity with the Undesirable Consequences

2. Describe a comparable activity without Undesirable Consequences

3. Compare the two to detect all differences

4. Write down all of the detected differences or distinctions that set the accident activity situation apart from the safe activity situation whether they appear to be relevant or not

5. Analyse the differences and distinctions to identify underlying changes, and to determine their effects on the incident. Give compounding or synergistic interacting of changes that increase their effects on incident Consequences

6. Integrate change analysis results with those of other analytical methods for confirmation, validation and clearer understanding of incident occurrence and prevention



Change Analysis WorksheetInvolvement Factors A.

Incident Situation B. Comparable Safe Condition

C. What Is Distinctive About “A”

D. What Has Changed In/About “C”

1. Who Workers Supervisors Management Others

2. What Object Energy Environment Barriers

3. Where Location On The Object In The Process

4. When In Time In The Process

5. Extent How Bad Trend

6. Management Control Control Chain Monitoring



Briefing and Class Exercise – Tools and Techniques (‘Checklist’ Analysis)

“Checklist” Analysis is helpful in exploring different aspects of the accident - for example three common human factors classifications

Person(s) Job

Organisation and management

Personal factors Job factors

Organisational and Management factors


Briefing and Class Exercise – Tools and Techniques (‘Checklist’ Techniques - Example)

“Checklist” Analysis is helpful in exploring different aspects of the acid leak

Person(s)Process operator back fromholidayProcess operator experience/ ability?Under stress?

JobPumps A and B are identicalLabels difficult to see (condition/ lighting)

Organisation and managementRegular Safety Inspections carried out?System failed to pick up operator familiarity issueTrainingRegular maintenance of lighting and labels


Briefing and Class Exercise – Tools and Techniques (Unstructured Techniques)

Unstructured methods are used to link ideas, usually at the start of an investigation

Acid leak

Site Investigation

Positioning of people

Witness

SafetyRegulator

OperationsShift Team

Maintenanceteam

ProcessOperator

Pumpcontrols

Positioning,Maintenance

of lighting and labels

Time delayfor emergency

ResponseKeep fit?

Physicallimitations

Tired

Investigation

Comms

Auto-pilot

Holidayeffect


Briefing and Class Exercise – Tools and Techniques (Causal Analysis - Summary)

To summarise, there are a variety of causal analysis techniques that can be used to assist the investigator

Causal Analysis Technique When is the technique useful?

Event and Causal Analysis Useful in: Illustrating and validating the sequence of events leading to the

accident and the conditions affecting these events Showing the relationship of immediately relevant events Providing an on-going method for organising and presenting

data Clearly presenting information regarding the accident that can be

used to guide report writing Providing an effective visual aid that summarises key information

regarding the accident and its causes in the investigation report Barrier/Defence/Change Techniques

Useful in: Ensuring that all failed, unused, or uninstalled barriers are

identified Understanding the impact barrier has on an accident

Checklist Techniques Useful in: Formulating questions

Unstructured Techniques Useful: At the beginning of the investigation when information can be

limited


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Individual Exercise – Case Study 1

Some information on a loss of containment incident

On the 24 September at 1010, 16-PIA-100L cooling water header low, pressure alarm was activated on NGL-1 control panel. The panel operator confirmed that both P-1618 B&C cooling water pumps were running as the running indicator was still illuminated. P-3001 A/B also indicated OK running status

Further checks showed that 16-MOV-100 on the on line cooling water filter S-1602A was shut. An open signal to 16-MOV-101 on standby cooling water filter S-1602B was given from the control room

An operator was sent to site to check/open the tripped MOV or bypass the filter as required

The Pressure in C-1302 Depropaniser Column increased rapidly to 19.8 barg, this confirmed the loss of cooling water

13-PRC-5-1 Depropaniser Column pressure control valve was fully open


Some information on a loss of containment incident (continued)

It was believed that 13-RV-10 C-1302 overheads relief valve had lifted

Due to the rapid rise in pressure it was deemed necessary to open the 13-HC-05 the C-1302 depressurising valve

The operator in the plant reported a huge noise but no gas cloud could be observed

Initially it was felt that the sound was due to the depressurisation of C-1302. It was hard to identify the source of the leak as the sound persisted, and the difficulty of the location

The Senior Operator identified the leak as coming from a vent line near E-1304D that had failed

The fire alarm was then actuated and the plant furnace and turbine were shutdown immediately



Some information on a loss of containment incident (continued)

It was found that the nipple of the ¾” vent on E-1304D had sheered off possibly due to the structure/piping vibrations resultant from the opening of 13-RV-10 and 13-HC-05

The plant was restarted on reduced feed and the vent nipple on E-1304D was replaced and the condenser commissioned and the plant normalised. 16-MOV-100/101 was kept on local mode

On visual inspection it was noticed that a number of pipe clamp securing bolts were sheared off

Probable causes:– Loss of cooling water to NGL 1, due to the closure of the cooling water inlet valve

16-MOV-100– 16-MOV-100 closing was due to a short circuit in the control cable



For this loss of containment incident complete the following tasks individually

Identify the Actual Consequences

Identify the Potential Consequences

Using the semi-quantitative process in slide 36 assess the potential of the event in relation to– PEOPLE– ASSETS/PRODUCTION– ENVIRONMENT – and REPUTATION by providing value (1-5) for each

Identify what level of investigation you would recommend. Give your reasons why



Suggested solution

Based upon the POTENTIAL CONSEQUENCES, recommend DETAILED FORMALINVESTIGATION

4-53-444-5POTENTIAL CONSEQUENCE

N/A1-22N/AACTUAL CONSEQUENCE

REPUTATIONENVIRONMENTASSET / PRODUCTION

PEOPLE



Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual



Suggested solution – Events and Causal Factors Chart

PlantIsolation

Weekend CleaningMaintenance

BlueShiftOn

TT/CSHandover0700

12 FeedUnit 270815

Unit 300Valve Open

TT ReportsNoise 0852

EmergencyResponse0900

LineIsolation0925

HospitalLeak



Suggested solution - Barrier Analysis

Physical

Double Block and Bleed Isolation

Emergency Response

Management Systems

Procedures

Handover Process

Training


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing - Evidence Gathering

This section (split into two parts) looks at the gathering of physical and human evidence which form the basis of effective accident investigation

Site investigation

Prioritising evidence

Correlating evidence

Cause or effect

Conducting interviews (Part 2)

Without evidence there cannot be an investigation!


Briefing - Evidence Gathering (Purpose of Site Investigation)

The purpose of the site investigation is to establish what happened and begin the process of understanding why the accident/incident took place/occurred

Building the PictureObtaining a clear understanding of factors, actionsand circumstances at the time of the accident/incident(immediate cause)

UnderstandingIdentifying the underlying causes that createdthe conditions for the accident/incident to occur

What happened?

Why?


Briefing - Evidence Gathering (Initial Assessment)

The Investigation Leader needs to plan the investigation and have clear objectives based on an initial assessment of the event

If there is a delay in appointing an Investigation Leader, then the Incident Commander must take on this role

What Happened?What Happened?

Where Did the Event Take Place?Where Did the Event Take Place?

What Was Involved?What Was Involved?

Who Was Involved?Who Was Involved?

What Is the Extent of the Site or Affected Area?

What Is the Extent of the Site or Affected Area?What Were the

Consequences?What Were the Consequences?

Why Did it Happen?Why Did it Happen?

What Resources Are Needed to investigate?

What Resources Are Needed to investigate?


Briefing - Evidence Gathering (Information Gathering)

It is a responsibility of the Incident Commander to ensure a current record is maintained of all evidence gathered and actions taken

Statements/reports

Relevant records

Time

Results of examinations

Photos, sketches, recordings

Control equipment

Data recorders

Communications

From persons involved and witnesses

Shift log book, defect records, maintenance records

Recorded time when the accident/incident occurred. Also the times of other relevant events and when evidence was collected

Technical examinations or tests on equipment

Audio or visual recordings together with photographs, sketches and notes both on and off site together with other relevant information

Control panel indications and alarms

Downloading data recorders or extracting data from control equipment

Control room/operator communications, actual messages and channels in use


Briefing - Evidence Gathering (Basic Techniques and Equipment)

There are a number of ways to record evidence at the site quickly and accurately and best results are obtained by combining several techniques

Sketches

Notes

Photographs

Video Film

Sample Collection

Tape Recorders

Measuring Equipment


Briefing - Evidence Gathering (Prioritising Evidence)

Site evidence needs to be categorised and top priority given to recording and gathering perishable evidence

Available evidence

Retrievable evidence

Perishable evidence


Briefing - Evidence Gathering (Prioritising Evidence)

Major factors affecting the recording and gathering of perishable evidence are elapsed time and the recovery and restoration activities

Elapsed time

Clearance or recovery operations


Briefing - Evidence Gathering (Examples)

Examples of types of evidence

Perishable– Weather conditions– Human memory– Equipment positions

Retrievable– Equipment components (if labelled/preserved initially)– Maintenance records– Medical and training records– Control system data

Available– Local, national and international maps– Legislation– Company and international standards


Briefing - Evidence Gathering (Correlating Evidence)

Cross-checking or correlating the evidence with other evidence is a necessary part of the investigation process

Correlation of damaged pipe racks and pipes with Control Room records showing flow data can indicate which pipes failed initially

Blood stains can indicate where injury occurred and what caused the injury. Blood samples would be analysed

Detached components from rotating equipment can help to identify the sequence of events. The components would be identified with particular rotating equipment and evidence of damages or failure

Broken glass or paint fragments can indicate a point of collision. Samples would be matched against vehicles or components

Tyre marks on a road surface can indicate the direction, and possibly the speed, of a road vehicle. It would be important to demonstrate that the vehicle concerned made the marks

examples


Briefing - Evidence Gathering (Cause and Effect)

Evidence at accident sites may be associated with the cause of the accident or the effect (or result) of the accident

Chicken or Egg?


Briefing - Evidence Gathering (Initiating and Managing Technical Investigations)

The necessity for technical investigations depends on the type of accident/incident, the evidence available, and relevance to the investigation process

On sceneMechanical EngineersElectrical EngineersOperations ManagersSafety ManagersStructural EngineersFire TechnologistScientists/Technicians

Off sceneMetallurgistsQuantified Risk AssessorsSafety Case ManagersToxicologists

Careful management is necessary to ensure validity of results


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Suggested solution – Events and Causal Factors Chart

PlantIsolation

Weekend CleaningMaintenance

BlueShiftOn

TT/CSHandover0700

12 FeedUnit 270815

Unit 300Valve Open

TT ReportsNoise 0852

EmergencyResponse0900

LineIsolation0925

HospitalLeak

DBB Contractor

NoProcedure

PermitWeak

Supervision

Bill Jones

Blue Shift

T Thomas

Blue Shift Bill Jones

Toxic Gas

BleedValve

45 Mins

350kg

No Detection

Degassed

Spades Spades?Spades?Completed?

HSERIDDOR

Who?TT 6 MthsExperience


Red Shift

Risk AWeak

PermitSignature

Spades?

DrainOpen/Close

?

Road Block


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing - Evidence Gathering (Planning and Conducting an Interview)

Whether taking place at the scene or at the formal investigation stage, interviewing can be considered to consist of three stages

Reporting3

Execution2

Preparation1


Briefing - Evidence Gathering (Interview Preparation)

Preparing for an interview can be further divided into five steps

Careful preparation will result in less time being wasted askingunnecessary questions and focus the interviews on key information needs and gaps

Step 1: Defining Objectives

Step 2: Selecting Interviewees

Step 3: Designing the interview questions

Step 4: Researching Information - and possibly going back to step 3

Step 5: Arranging the interviews

Preparation1


Briefing - Evidence Gathering (Witnesses)

Witnesses who could be interviewed following an accident can be placed in four categories

Usually interviews at the scene are used to establish the facts. At the formal investigation stage, witnesses may be asked to build on the established facts and potentially give opinions

Direct Witnesses

Indirect Witnesses

Circumstantial Witnesses

Expert Witnesses

Interviewed on-site (post accident)

Interviewed at formal investigation

stage

Establishment of facts

Obtaining anOpinion

Lessdirectly

‘involved’in accident

Likelytiming

ofinterview

Likelypurpose

of interview


Briefing - Evidence Gathering (Attendance and Confidentiality)

The formal investigation team should understand whether a witness is obliged to attend and how confidential their evidence would be if they do attend

The Requirement to Attend

Limitations to Confidentiality

Witnesses can refuse to co-operate, although the formal investigation team must reach conclusions in their absence

Relevant information arising from the formal investigation will be used in the ReportSafety Regulators and/or Police can use information in the Report to direct their investigations


Briefing - Evidence Gathering (Interview Execution)

The execution of an interview can be further divided into introduction, dialogue and closing

The choice, construction and delivery of questions is probably the most important part of interview execution

Introduction - setting the stage

Dialogue - listening, questioning, summarising, clarifying, coping with questions

Closing - summarising and taking leave

Execution2


Briefing - Evidence Gathering (Questions)

It is likely during questioning that you will use a mix of open and closed and neutral and biased questions

Elicit informationElicit information Probe/check

Provoke Test hypothesis

OPEN CLOSED

NEUTRAL

BIASED



Open questions are used to introduce a new topic and are often used at the beginning of the interview

For example

As a starter, can you briefly outline what the work at xxx is?

In your own words can you tell me what happened on the day of the accident?

For my information, and perhaps for everybody’s here, could you tell me what your job is and what your responsibilities are?

Please describe, to start off with, the job that you were doing when the accident occurred?



Closed questions are used to elicit very specific information, enabling the interviewee to offer a limited range of possible responses which can after be summarised in one word answers

For example

Do you know any details of what the electrical equipment work involved? YES/NO

When they went out to tender for the contract, did they include a pre-tender safety plan? YES/NO

Would that review consider safety issues, such as the location of designated earthing points? YES/NO



Neutral questions are used most of the time, to establish facts, rather than for obtaining an opinion

For example

How many people should it take to do this job? – (Biased: Wouldn’t you agree that this job needs twice the number of people now

on it?)

How did you feel about that? – (Biased: And I expect you were not very happy about that?)

Was there anyone on site who had the information to be able to call an ambulance quickly? – (Biased: So there was nobody on site who had the information to be able to call

an ambulance quickly?)



Biased questions are useful to test hypothesis or to challenge genuine responses, and when you want to overcome resistance or evasiveness

For example

So as Project Manager you are not actually monitoring the safety checks on a weekly basis? (Neutral: So as Project Manager how often do you monitor the safety checks?)

Is it now emerging that the part to which you fit a short earth was not installed two weeks previously when the design shows it should be? (Neutral: When did you realise the part to which you fit a short earth was not installed?, When does the design show it should have been installed?)

Because the question that I’ve got really is, didn't you have this particular method statement with you, even though you were the Supervisor originally? (Neutral: Did you have the method statement with you?)


Briefing - Evidence Gathering (Reporting)

Write up interviews while they are fresh in your mind. Generally, a good interview memo covers the background, your conclusions supporting evidence and next steps (if any)

BackgroundInterview: purpose, length, date and participantsInterviewee: Name, job title, responsibility, history

Conclusions and EvidenceProvide conclusions (factual and emotional)Tie your conclusions back to the issues identified during preparationSupport each conclusion Formulate opinions

Next StepsRecommend next steps (if any) e.g. discuss issue with team member

Reporting3


Briefing – Evidence Gathering

Exercise on managing difficult interview situations

Objective

The purpose of this exercise is to identify and then manage different types of interview situations that could potentially occur while conducting an accident investigation

Instructions

Read the following scenarios and answer these questions for each:

What is happening?

What would you do in this situation?



Scenario AYou are asked to interview Mr Baxter, who is a member of a shift team who recently had an accident where an operator (Joe Chaple) died. You start to question Mr Baxter about Mr Chaple, his fatally injured workmate. You ask “In what state was Mr Chaple, this morning when he started work”. Mr Baxter replies “Joe Chaple, he was the best, um, safest worker around, you could always depend on Joe”. You then ask “So how was he this morning?”. He replies “Joe was fine, he was always fine, he was my best friend”



Scenario BA formal investigation is underway, and the Team has decided to interview Tim Berry, Millennium Maintenance’s Head of Operations. In an attempt to obtain information regarding the safety management system at Millennium Maintenance, you ask Tim Berry, “How does Millennium Maintenance organise their Safety Management System?”. Tim replies “Well it is a lot better organised than your company’s”



Scenario CDuring a formal investigation, a member of the investigation team who is from Millennium Maintenance has started to interview Mr Baxter (a Millennium Maintenance crew member). He starts his part of the interview with “In your own words, describe what happened on the day of the accident”. However, before Mr Baxter has a chance to answer, the Millennium Maintenance interviewer continues with “It’s probably best if you start by telling the Team how Mr Plumber (the Supervisor) had briefed you that morning about safety and informed you how the safe system of work would operate!”



Scenario A

You are asked to interview Mr Baxter, who is a member of a shift team who recently had an accident where an operator (Joe Chaple) died. You start to question Mr Baxter about Mr Chaple, his fatally injured workmate. You ask “In what state was Mr Chaple, this morning when he started work”. Mr Baxter replies “Joe Chaple, he was the best, um, safest worker around, you could always depend on Joe”. You then ask “So how was he this morning?”. He replies “Joe was fine, he was always fine, he was my best friend”

Suggested SolutionThe interviewee has become evasive

The temptation here is to start asking closed questions, which could well make the situation worse. As yet you have not really established whether Mr Baxter is being evasive because Joe Chaple was his best friend or he wants to protect his job and Millennium Maintenance's contract. If it is the latter, it is unlikely you will be able to find out much more about the state of Joe Chaple and it is not worth during this interview further progressing this line of questioning (at the inquiry stage when the dust has settled, you can remind witnesses of their legal requirement to co-operate). However, at this stage it may be that Mr Baxter is being evasive because he feels a duty to Joe as his friend. Therefore, you could make the next question even more open e.g. “What was the general state of the gang this morning?” and then depending on the answer come back to questioning about Joe specifically. It is also not unreasonable to show some compassion at this stage and say something like “Obviously, I did not know Joe, but from what you are saying he sounds like a great guy” and then something like “I think for Joe’s sake it is important we find out what really happened, How was he this morning?”



Scenario B

A formal investigation is underway and the Team has decided to interview Tim Berry, Millennium Maintenance’s Head of Operations. In an attempt to obtain information regarding the safety management system at Millennium Maintenance, you ask Tim Berry, “How does Millennium Maintenance organise their Safety Management System?”. Tim replies “Well it is a lot better organised than your company’s”

Suggested SolutionThe interview has already started to focus on blame, rather than establishing the facts of the accident. The interviewee has also started to become hostile

The interviewer must not get angry. You must also not take sides. Your questioning could therefore repeat the purpose of the investigation i.e. to identify the circumstances behind the accident with the object of ensuring effective management control and identifying immediate and root cause(s) as a means of preventing, or reducing the likelihood of, recurrence. “The purpose of this inquiry is not to blame any particular person or company. We are really just trying to find out what kind of Safety Management System Millennium Maintenance has”



Scenario C

During a formal investigation a member of the investigation team who is from Millennium Maintenance has started to interview Mr Baxter (A Millennium Maintenance crew member). He starts his part of the interview with “In your own words, describe what happened on the day of the accident”. However, before Mr Baxter has a chance to answer, the Millennium Maintenance interviewer continues with “It’s probably best if you start by telling the team how Mr Plumber (the Supervisor) had briefed you that morning about safety and informed you how the safe system of work would operate!”

Suggested Solution

The Millennium Maintenance team member has asked a leading question, and therefore we are unlikely to find out what was in the safety briefing on the morning of the accident, or even if there was one

It is the role of the Investigation Leader to control the proceedings of a Formal Investigation. He should therefore step in at this stage. However, if he does not, depending on how serious the leading questioning becomes, you should direct your concerns through the Investigation Leader, perhaps by suggesting a break and then discussing it with him and the other team members during the break, or write that you are concerned about the process and a break might be useful on a piece of paper and hand it to the Investigation Leader


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual



Interview key Information that could be obtained

Interviewee was asked to be evasive

Communication is not good between Trevor and his operators

Thomas was not present at the handover and this was delegated to Bill Jones

Briefing to operators of start up procedure was not good

Double block and bleed not not explicitly shown on plan

Contractor management experience/relations is not good

Always previously worked alongside the contractor

Not had any training in Isolation although responsible for the development of the procedure



Interview technique – The following stages should have be undertaken

Introduction (both Interviewer and Interviewee)

Questioning – Open– Closed– Neutral– Biased

Was the interview structured and did the Interviewer concentrate on verifying the sequence of events and conditions

Close Out– Did the interviewer feedback what he had heard


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing – Introduction to Human Factors

Human factors are important to consider and understand when investigating incidents and accidents

Cross-industry evidence has found that ‘human failure’ contributes to more than 75% of incidents

The discovery of ‘human failure’ is not sufficient – we need to discover the causes of human failure so we can work towards prediction and prevention

As a discipline, human factors provides a body of:– Knowledge– Tools– Techniquesto investigate the causes of ‘human failure’


Briefing - Introduction to Human Factors

The discipline of Human Factors takes a “user centred” approach to understanding systems where people interact with technology to perform a task

MachineOperator

Display instrument

Production

Control instrument

Interpretationdecision

Handling ofcontrols

Perception

(“Man”)

Human-Machine InterfaceHuman

Capabilities

EquipmentDesign

Physical WorkEnvironment

OrganisationalWork Environment

Example of a human/machine

“system”



Individuals bring a range of Personal Factors to work that can affect incidents and accidents

Individual/Personal Factors What an individual brings to work that affects their performance

Physical fitness Ill health/incapacitation Influence of medication

Psychological fitness Personality traits/suitability State of mind Psychological conditions/illness

Age and experience Age/maturity Experience in current and previous roles

Competency Insufficient Knowledge/experience Skill



The causes of human failure need to look beyond the individual to consider the contribution of the task environment and wider organisational context

Personal/Individual Factors

Characteristics that an individual brings to a work situation that affects the person’s performance

Job/Situational Factors

Factors associated with the task and the environment they are being performed in

Organisational and Management/System Factors

Factors associated with complex organisational and social systems


Briefing - Introduction to Human Factors (HSE 48 model)

Human Factors in accident investigation is concerned with the aspects of a system which make it vulnerable to human failure

“Human factors refer to environmental, organisational and job factors, and human characteristics which influence human behaviour at work in a way which can affect health and safety” (HSE Definition)

Personal/Individual Factors

Low skill and competence levelsTired staffBored or disheartened staffIndividual medical problems

Job/Situational FactorsIllogical design of equipment and instructionsConstant disturbances and interruptionsMissing or unclear instructionsPoorly maintained equipmentHigh workloadNoisy and unpleasant working conditions

Organisation and Management/System FactorsPoor work planning,leading to high work pressureLack of safety systems and barriersInadequate responses to previous accidentsManagement based on one-way communicationDeficient co-ordination and responsibilitiesPoor management of health and safetyPoor health and safety culture



Human failure can be divided into unintended actions and intentional behaviour

Human failure is often cited as a causal factor in accidents. It is therefore important to understand how it can be understood as part of the investigation process

Un-intentionalActions

IntentionalActions

Slip

Lapse

Mistake

Violation

Skill - based

Attention failure

Recognition failure

Memory failure

Rule based

Knowledge based

Routine

Situational

Exceptional

Personally optimising

Sabotage

HumanFailure



The key to preventing workplace violations is understanding the unwritten rules that are driving them

Introducing more discipline or enforcement may not always be the answer

The workers would not follow the rules...

The workers would not follow the rules...

…so management introduced more discipline...

…so management introduced more discipline...

…but the workers still didn’t follow the rules.

…but the workers still didn’t follow the rules.

Why not?

Because often violationsare reasoned responses giventhe prevailing circumstances,not just wilful disobedience



Motivators are the ‘reasons’ why people decide to break the rules. There are five main types of motivators to consider

Rule considered unnecessary/violation has become normal working practice

Rules are difficult/impossible to follow in the work situation

Rule breaking due to unusual circumstances (e.g. emergency) often with unknown outcomes

Violation to benefit personally e.g. financial gain, making lifeeasier

Due to conflict, intending damage or harm

Routine

Situational

Exceptional

Personally optimising

Sabotage

MOTIVATORS


Modifiers are the conditions which make violating more or less likely. There are eight common types of modifier


MODIFIERS

1. Poor perception of risk

2. Low chance of detection

3. Ineffective disciplinary procedures

4. Lack of reward for safe practice

5. Poor accountability

6. Poor supervisory style

7. Complacency caused by accident-free environment

8. Inadequate management attitude


Once motivators and modifiers have been identified, the causes of violations will be much clearer, and possible solutions can be established


Likely Areas for Action

Awareness campaignsIncreased monitoring/detectionMore effective disciplinary procedures

Driving over the speed limit on a highway

Motivators Modifiers

Routine (driver has at some point decided the rule is unnecessary)– Cars are safer– Belief in own ability to

drive at speed higher than limit

Poor perception of riskLow chance of detection

example


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing – Corporate Safety Culture

The Corporate Safety Culture is also an additional factor to consider and understand when investigating incidents and accidents

Good corporate safety culture starts with:

Visible commitment and demonstration from the senior management and active implementation of safety policies by all employees

Development of the belief that all accidents are preventable though implementation of suitable procedures and encouragement of suitable safety behaviour


A good corporate safety culture will be supported by systems, processes and visible commitment. Best Practice guidelines include:

Drafting a clear HSE policy that is communicated and discussed with all staff before being made final

Informing the staff of the need to be open and transparent with a commitment from management that no punishment will be attached to any incident reported – a no blame culture

Consulting employees and involving them in the setting up of the HSE reporting system, other HSE systems and issues

Implementation of systems for proactive monitoring and related reporting of HSE matters e.g. audits, inspections, surveillance, sampling, etc.

Implementation of proper systems in place for reactive and reporting measures following incidents

Devising straightforward and easily followed reporting systems with a minimum of paper work

Briefing - Corporate Safety Culture


A good corporate safety culture will be supported by systems, processes and visible commitment. Best Practice guidelines include: (continued)

Conducting training to clarify the requirements and to ensure proper understanding and adherence to the system

Conducting awareness campaigns and training sessions to all staff to emphasise the importance of reporting all HSE incidents and near misses

Visible commitment from senior management providing the good example for staff regarding the adherence to safety rules and the demonstration of commitment

Given high priority to HSE matters and their resolution once identified

Financial and career incentives to reward good safety performance

Briefing - Corporate Safety Culture


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing - Interface Management (Stakeholders in the Accident)

As soon as the accident takes place, there may be other interested parties who may help and or restrict the investigation process

EmergencyServices

Police

Government

SafetyRegulator

LossAdjusters

Media

Municipality

AccidentRelatives ofvictims

OtherCompanies


Briefing - Interface Management (Stakeholder Expectations)

What are the expectations/needs of these stakeholders?

How will these expectations impact on the formal investigation?

Stakeholder Expectations/Needs of Stakeholder

Emergency Services

Other Companies

Police

Government

Safety Regulator

Municipality

Media

Relatives of Victims

Loss Adjusters


Briefing - Interface Management (Stakeholder Expectations)

What are the media’s needs?

To be the first with the news and meet deadlines

To publish details of casualties

To give human interest stories

To present the facts including statistics

To bring stories to life with interviews and quotes

To show dramatic pictures

To describe events as they develop

To establish the cause

To find new angles different from other coverage


Briefing - Interface Management (Incident Management)

Three levels of incident management are typically set-up

STRATEGIC Headquarters

TACTICAL Refinery

OPERATIONAL Incident scene


Briefing - Interface Management (Accident Management)

There are a range of related activities, depending on the accident consequences

Incident ControlIncident Control

Emergency Response

Emergency Response

Emergency ManagementEmergency

Management

Crisis ManagementCrisis Management

Fire fightingFirst AidDamage ControlRepair

Fire fightingFirst AidDamage ControlRepair

Co-ordination of operational supportLiaison with Emergency ServicesCo-ordination of operational supportLiaison with Emergency Services

Manages impacts on business’s image, operations and liabilitiesManages impacts on business’s image, operations and liabilities

Manages impacts on corporate image, operations and liabilitiesManages impacts on corporate image, operations and liabilities

Handling of Government, media, partners, shareholders, etc.Handling of Government, media, partners, shareholders, etc.

OperationalTactical

Strategic

Strategic

Elements of Tactical

Overall management of the emergencyCo-ordination of broader supportLiaison with customers, government etc.Media & relatives

Overall management of the emergencyCo-ordination of broader supportLiaison with customers, government etc.Media & relatives

Tactical

OperationalTactical


Briefing - Interface Management (Blame Processes)

The formal investigation is aimed at prevention/mitigation. However, information produced has historically been used to attribute blame

FormalInvestigation

“Prevention/Mitigation”Process

Information

Contractual Disagreements

Insurance Claims

Allocation of lost revenue

Criminal Charges - Individual/Corporate

“Blame” Processes


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Some information on a crushed finger incident

Whilst engaged in soil boring operations for the preparation of a storage tank base at an onshore petrochemical plant and during routine change-out of a worn bit, the sub contract drill operator sustained a crushed finger

This injury occurred whilst unscrewing the drill string, when the drill string separated from the connecting collar and dropped trapping the operator’s finger against the ground

The drill operator was not wearing gloves at the time of the incident

The drill mast is capable of being laid in the horizontal position and it was customary to turn the mast to the 45o position from the vertical, but it was vertical when the incident happened

There was no procedure requiring the mast to be laid horizontal for bit changes, the practice for bit changes is passed from operator to operator during the training period



Some information on a crushed finger incident (continued)

The bedrock at this location is particularly hard and has Sub-surface cracks and fissures, which cause loss of airlift to the cuttings

The hard bedrock increases the frequency of bit changes, which also increases the frustration level of the operator

The work-pack for this work did not identify that the bedrock was unusually hard and required special hardened bits

The contract did not specify the requirements to provide procedures for the specified activities



As a team complete a Summary Analysis for the incident report provided

Identify the following:

Consequences/event

Controls

Immediate Causes - “Unsafe Acts and Unsafe Conditions”

Preconditions - “Personal, Job and Management Factors”

Underlying (Root) Causes - “Systems Failures”

Areas where information was insufficient or incomplete

Areas requiring additional investigation?



Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Emergency Management Planning

This section builds on the Emergency Management Planning section of the HSE Management Systems Course, looking in more detail at Emergency Planning and Emergency Response Management

Management and Authorisation for operation of Hazardous Installations

Emergency Planning– General Principles– Offsite Emergency preparedness programmes– Onsite Emergency Planning – Training, Drills and Exercises

Emergency Response Management– Potential Company Reputation Damage– Emergency Response Plan– Personnel Response Team


Briefing – Management and Authorisation for operation of Hazardous Installations

The Public Authority should have established a clear and coherent control framework for the management and authorisation of hazardous installations

1. Definition and establishment of requirements for differenttypes of installation

3. Arrangements for monitoring of the safety performance of the installation

4. Criteria for enforcement action in case of non-compliance

5. Development,implementation and

testing of onsite and offsite emergency plans

6. Requirement for cooperation and coordination between onsite and offsite emergency response teams

Control framework

content

2. Establish procedures and criteria for the planning, siting, licensing and permission to operate withindefined operating criteria


Briefing – Emergency Planning – Guiding Principles

Emergency planning development is a critical part of any hazardous installation’s risk management program

The principle objective of an emergency response plan is is to localise any accidents that may occur and, if possible, contain them and minimise any harmful effects of the accident on health, environment and property

Emergency planning should include both onsite and offsite emergency planning:

Onsite accidents Offsite storage areasPipeline accidents

Road transport accidents

Ship bulk transportation


Emergency planning should be undertaken by both the Public Authority and the hazardous installation in parallel

There should be close cooperation and coordination between those responsible for onsite and offsite emergency planning

The onsite and offsite emergency plans should be consistent and integrated and should be based upon both generic and specific hazards and potential accident scenarios including low probability, high consequence incidents

Onsite and offsite integration

The emergency planning process should consider complicating factors, e.g.:

Complicating factors

Loss of power and utilities Difficult weather conditions

Onsite maintenance Day/night and weekend incidents

Briefing – Emergency Planning – Guiding Principles


The emergency planning process should also include an evaluation of potential hazardous scenarios, existing infrastructure and what improvements are required

During the emergency planning process there should be a realistic evaluation of competencies and resources

The emergency planning should consider any requirements for backup systems – Succession training – Alternative communication channels– Second accident command centre – Site evaluation planning– Mutual assistance between sites within

an industrial complex

Necessary financial support should be provided to ensure all emergency response equipment is maintained, available and the emergency response teams are trained in their use

Briefing – Emergency Planning – Onsite and Offsite Emergency Planning


Onsite and offsite emergency plans should include the following…

Full scale plan of the installation

List of identified generic and specific hazardous situations

List of all hazardous substances handled identifying location on site, process conditions and basic safety information

Information on the emergency shutdown and isolation philosophy

Location and description of emergency response equipment

Roles and responsibilities for personnel

Description of evacuation procedures and personnel refuge locations

Procedure for notification of accidents to local/national public authorities

Onsite emergency plan

Full scale map of the installation and surrounding area

List of identified generic and specific hazardous situations

List of all hazardous substances handled and process conditions

Roles and responsibilities

Location and contact details for public authority communication/command centres

Contact numbers of national experts on emergency response, and international response teams

Media communications spokesperson

Offsite emergency plan

⇒ The onsite plan should be completed by a team of professions including engineering, operations, HSE department and emergency response.

⇒ The offsite plan should be completed by a team of professions from the hazardous installation, public authority and public emergency services

Briefing – Emergency Planning – Onsite and Offsite Emergency Planning


Briefing – Emergency Planning – Training, Drills and Exercises

Rapid and effective implementation of the emergency response plan requires the primary response teams to be familiar with the site, equipment and emergency plan requirements

All emergency response teams (onsite, mutual assistance teams,offsite emergency response) should be familiar with:– The site layout– Location of key installations

(emergency gates, water and foamsupply points, refuge locations etc)

– The potential hazardous materials handled

– Emergency plans and personnel

The emergency plans and training should provide guidance and principles and not be too prescriptive to allow for a flexible response to the accident


Rapid and effective implementation of the emergency response plan requires the primary response teams to be familiar with the site, equipment and emergency plan requirements (continued)

Regular exercises of both onsite and offsite should be undertaken, and include where appropriate mutual assistance and offsite emergency response teams:– The exercises should be observed and assessed by independent personnel as a

means for identifying areas for improvement– The exercises should be programmed to test different aspects of the emergency

plans and include both desk top and onsite exercises– The exercises should also be undertaken in adverse

conditions e.g. night shifts – Feedback from the exercises should be provided to

the senior management, incident commanders/coordinators and emergency response team. This should be used as a basis for – Identification of insufficient resources– Training and development– Correct action of third party – Evaluation of the emergency plans

Briefing – Emergency Planning – Training, Drills and Exercises


Effective Emergency Response Management is critical to ensure that an emergency doesn’t escalate into major crisis/disaster

Poor incident management can result in a public perception that the company is incompetent and unprepared for such situations resulting in an immediate significant loss in the company’s asset valuation and reputation

Damage to a company’s reputation can have significant impact on an company’s operations:– Loss of investor confidence– Poor employee morale– Delayed regulatory investment planning approvals– Increased insurance premiums etc.

The effective management of an incident requires a suitable organisational structure in many cases different to that required for normal day-to-day operations, requiring different specialist functions, teams, procedures, reporting structures and communication channels to be mobilised

Briefing – Emergency Response Management – Potential Reputation Damage


How a company manages a local emergency can have worldwide implications on the company’s operations given the speed of the media

Lord Cullen noted in the Piper Alpha disasterreport that:

“I am not satisfied that the systemas operated on Pipe Alpha can close to achieving the necessary understanding on thepart of all personnel as to how to act in the case of an emergency.” He added that management “failed to ensure that emergencytraining was being provided as they intended.

The platform personnel and management were not prepared for a major emergency as they should have been. The safety policies and procedures were in place: the practice was deficient”

The perception that a company has reacted badly to an emergency, right or wrong, tends to reinforce the view that that it must have been incompetent in allowing the incident to occur in the first place

Briefing – Emergency Response Management – Potential Reputation Damage


Many companies develop a separate Emergency Response Plan to ensure effective incident management

The Emergency Response Plan focuses on the systemsand facilities required for the wider management of theincident:– Minimising casualties and providing the necessary

infrastructure for evacuation– Treating and identifying the injured (on and off-site)– Systems for ensuring that all personnel are

accounted for as rapidly as possible and relatives informed to minimise worry

– Meeting survivors and making provision for their immediate welfare and immediate relatives

– Providing the necessary long term personnel and back-up equipment/supplies– Communication of information between the site, central headquarters and other

sites– Informing employees of what has happened and what action should be taken– Limiting the impact on the company’s reputation and market value

Briefing – Emergency Response Management – Emergency Response Plan


Many companies develop a separate Emergency Response Plan to ensure effective incident management (continued)

The development of the Emergency Response Plan will typically depend upon a two important factors: the site and geography, and the size and culture of the company

The Emergency Response Plan should typically include consideration of the following:– Defining the extent of the emergency and necessary immediate action– Organisational structures and accommodation– Manpower management and movements– Access and transport to site for mobilisation of response teams– Management of survivors and their relatives– Team support functions– External communications and communication equipment– Documented action and communication records– Financial management – Legal support

Briefing – Emergency Response Management – Emergency Response Plan


The Personnel response team is a function in a major disaster managing the communication between the company and relatives

The personnel team has a responsibility to remove pressure from the onsite emergencyresponse and operational teams, alleviating theworry felt by relatives and limiting the damageto the company’s reputation

The largest single problem that needs to be considered during the development of the Emergency response plan is the rapid and accurate location of personnel at the time of an emergency

Telephone operators:– Should be trained appropriately– Should document the caller identity, condition,

date and time of call in a log sheet

Briefing – Emergency Response Management – Personnel Response Team


The Personnel response team is a function in a major disaster managing the communication between the company and relatives (continued)

To ensure that the organisation has the necessary company policies in place and systems for collation of information in the event of an emergency

The following are typical questions asked by relatives in the event of a major accident:

Was he working at the site at the

time of the emergency?

Is he alive?

What is his condition now and what are you doing to help him? Where is she

now and can I see her?

How do I get to….?

Will you organise my

travel, and when can I leave?

Will he be able to work

again?

Briefing – Emergency Response Management – Personnel Response Team


The company should have the necessary systems and organisation in place to ensure effective media communications is established and maintained

It is not advisable to prevent access to the media as it can result in the development of rumours and speculation about the incident, which are not based on facts

A lack of accurate and prompt informationprovides an overall perception of lack of planning, ineffective incident managementwith the potential for rapid reputation damage

A constructive relationship should be established with the media to ensure that the company is:– Established as competent and responsible– Controlling the incident and doing all that can be done to minimise the impact of

the accident– Able to manage its image and reputation– Able to communicate to local residents directly and efficiently

Briefing – Emergency Response Management – Interfacing with the Media


Effective media communications are critical to minimise the potential for local impact on company operations

To ensure that these objectives are met themedia communications team should:– Control the flow of information about the

incident– Act as a single authoritative source of

information– Ensure that the information is standardised

and consistent– Use the media to obtain information (e.g.

public feeling, external perceptions)– Maintain the media’s interest to minimise

the potential local impact on operations – Emergency response activities– Overload of company telephone network– Uncontrolled interviews and personnel opinion– Company subsidiary operations



The company media response team should have the necessary systems and organisation in place to access and collate information requirements

To ensure that the organisation has the necessary systems for collation of the information, the following are typical questions asked by the media in the event of a major accident:

What is the emergency telephone

number that relatives should

call?

What has happened

and where?

How many people were on the site at the

time of the accident? When will

normality be restored?

What is your safety

record?

What is the senior

management’s reaction to the

accident? Have there been any injuries or fatalities?




Company fact files containing general company information can beprepared and used immediately in the event of a major accident

In addition to the accident response information, many companies develop company and facility fact files that contain general background information which can be provided along with the holding statement to the media

These fact files are not incident or accident specific but contain information such as:– Background on the company including

International and National activities– Map of location– Picture of the facility– General information of production activities and

number of employees– Facilities in the vicinity of the plant – Company and site specific safety performance

statistics– Glossary of technical terms

It is important to ensure that all press statements issued are consistent to what has been issued before, and do not try to hide changes in information or situation


During the accident investigation it is important to concentrate on identifying the immediate and underlying causes. However it is also important to analyse the effectiveness of the Emergency Response

Briefing – Emergency Management Planning – Assessment

Incident DetectionIncident DetectionHow was the incident detected?Did any systems fail?How long did it take for the incident to be detected?Was the incident independently confirmed?

How was the incident detected?Did any systems fail?How long did it take for the incident to be detected?Was the incident independently confirmed?

Incident Notification

Incident Notification

Were the correct notification procedures followed?Were the correct personnel notified and contact details correct?How was the alarm raised?

Were the correct notification procedures followed?Were the correct personnel notified and contact details correct?How was the alarm raised?

Incident ControlIncident ControlAny problems with the first line response - equipment, containment? Any problems with site communication channels or responsibilities?How effective was the site first aid and medial services?

Any problems with the first line response - equipment, containment? Any problems with site communication channels or responsibilities?How effective was the site first aid and medial services?

Emergency Response

Emergency Response

Any communication problems with 3rd parties and response time?Were the 3rd party response teams – prepared, site access, site knowledge?How well did the 3rd party teams integrate with site response teams?

Any communication problems with 3rd parties and response time?Were the 3rd party response teams – prepared, site access, site knowledge?How well did the 3rd party teams integrate with site response teams?

Emergency ManagementEmergency

ManagementAny problems in mobilising and coordinating emergency response plan?How effective was the communication with adjacent hazardous facilities?How effective was the communication with regulators, municipality etc?

Any problems in mobilising and coordinating emergency response plan?How effective was the communication with adjacent hazardous facilities?How effective was the communication with regulators, municipality etc?

Crisis ManagementCrisis ManagementHow did the personnel and media communication teams perform?How effective was mobilisation of expert emergency response teams?How effective was the long term support and damage control actions?

How did the personnel and media communication teams perform?How effective was mobilisation of expert emergency response teams?How effective was the long term support and damage control actions?


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Briefing - Write-up and Presentation

The overall goal of an accident report is to document the investigation findings, conclusions and recommendations clearly and accurately

In this section we will consider the:

Format of the investigation reportGeneral principles in report writingDiscussionConclusionsPlain EnglishRecommendations


Briefing - Write-up and Presentation (Format of the Report)

Good practice in structuring formal investigation reports

Part A - Title, reference number, date

Part B - The following statement:"The investigation has been conducted with the objective of determining the facts of the accident/incident, the immediate and underlying causes, and of making recommendations to prevent, or reduce the risk of recurrence. The report is for the use of persons with a direct responsibility for improving, or maintaining, process industry safety.The objectives of this inquiry/investigation were not the allocation of blame and liability and thus the information contained should not be construed as creating any presumption of these.”

Part C - A copy of the Terms of ReferencePart D - Details of the accident/incidentPart E - A brief description of the sequence of eventsPart F - A summary of the evidence considered relevantPart G - DiscussionPart H - The conclusion(s), including the immediate and underlying causesPart I - The names, and signatures, of investigation team membersPart J - Recommendation(s)Appendices - Other information relevant to the understanding of the report


Briefing - Write-up and Presentation (Investigation report structure)

The Report structure described is designed to improve the traceability of evidence through to recommendations

Summaryof

Evidence

Discussion

Conclusions

Recommendations

Sequence of Events E

F

G

H

J


Briefing - Write-up and Presentation (Investigation Report Structure)

Good practice in accident investigation report writing

Be accurate and indicate where the team have taken decisions based on conflicting evidence

Avoid the use of staff names – this helps to stay away from blame allocation

Get all the investigation team to sign the report – do not allow minority reports

Address all aspects of the Terms of Reference


Briefing - Write-up and Presentation (General Principles in Report Writing)

The following principles provide useful pointers when writing the report

Do not overstate the factsState the facts as you have discovered them but avoid overly broad conclusions from facts

Do not say . . .

The maintenance contractor has not carried out any safety training in the last 5 years

If you mean . . .

None of the maintenance contractors in the team have had safety training in the last 5 years

example


example


The following principles provide useful pointers when writing the report (continued)

Distinguish between performance and documentationSome regulatory requirements specify that a particular activity or programme be conducted, but do not specify that the completion of the activity be documented

Do not say . . .

Weekly inspections of the site are not conducted

If you mean . . .

Weekly inspections of the site are not documented


example



Avoid generalitiesGeneralities and vague reporting will confuse and mislead the reader. The specific problem should be succinctly communicated

Vague

The contractor’s method statement was incomplete

More helpful

The contractor’s method statement did not:

a) Identify the hazards that would be encountered when completing the work

b) Indicate the control measures that would be implemented


example



Communicate the magnitude of the problemAlthough the wording of the description of the accident may be correct, it may not contain enough information to fully communicate the nature and extent of the problem

Poor

Members of the team were untrained

Improved

Three out of the ten team members involved in the job had not received any formal safety training


example



Avoid extreme languageRefrain from using such deprecating words as careless, terrible, dangerous, intentional, severe, reckless, incompetent

Poor

The maintenance team were incompetent in the way that the equipment had been isolated prior to the accident

Improved

A specific work procedure for the maintenance of the system had not been prepared, and the team had not followed general refinery practices to isolate the system using double block and bleed isolation and positive isolation of the control system


example



Use familiar technologyNot all recipients of the report will be involved in safety activities on a daily basis or know the technical terms used in specific petrochemical disciplines. They therefore may not be familiar with certain safety acronyms and jargon

Poor

The LEL HL alarm did not trip the BL ESV

Improved

The lower explosivity limit high level alarm did not trip the Battery Limit Emergency Shut Off Valve


example



Avoid contradictory messagesActivities presented in a positive light, when the ultimate message will involve pointing out deficiencies, may confuse the reader and obscure the real message

Poor

Although the Acid Plant has a process operator induction course, it lacks an overall assessment of competence

Improved

The Acid Plant process operator induction course lacks an overall assessment of competence


Briefing - Write-up and Presentation (Discussion)

The development of the Discussion section can be made easier by having on-going feedback with the team, summarising evidence in a specificaccident area

The Discussion section should specifically cover all aspects of the Terms of Reference

On-going feedback with team

Summarise evidence in a specific area

Develop the Discussion section with the rest of the team


Policy Control Co-operation Comms Competence Planning Implementation Measuring Performance

Review/ Audit

Industry

Company

Department Level

Supervision/Safety of Workgroup 2

Workgroup Level 1

Individual Level

Briefing - Write-up and Presentation (Discussion)

In addition to checking with the Terms of Reference a quick check can be made on the factors to be considered using a simple activity/organisation level grid

For example 1) The fact that the weather was cold could have been considered to be a

significant factor during implementation at the workgroup level2) The fact the Supervisor was not qualified would be a competence issue at the

Supervision/Safety of work group level


Briefing - Write-up and Presentation (Conclusions)

The conclusion should have at least two sections

It may also be appropriate to include in the conclusion any issues that have important safety implications but did not have any bearing on the accident

The Underlying Cause(s):“Underlying cause(s) are any factors which led to the immediate causes of accidents or incidents, or resulted in such causes not being identified and mitigated”

The Immediate Cause(s): “The immediate cause(s) is an unsafe act or unsafe condition which causes an accident or incident”


Briefing - Write-up and Presentation

Writing reports is a key skill for Investigation Leaders

The main ‘deliverable’ from an accident investigation is a report and within the reportsome recommendations

– The quality of accident investigations is usually judged by the quality of the report– The writing of the report is the responsibility of the formal investigation leader

“Everything we write has an impact and creates an impression”


Briefing - Write-up and Presentation (Clarity?)

Consider the following, taken from the Resolutions put to an Annual General Meeting of a Life Insurance company:

Is this plain English? ⇒ No!

(2) If, according to the terms of the policy or in consequence of assignation or other transference of any kind, the assignee has acquired or shall acquire the absolute right to such policy such assignee may, subject to paragraph (3) of this regulation, become a member in place of the person already a member of the Company in respect of that assurance if agreed between himself and the directors, provided that he complies with such requirements as may from time to time be prescribed by the directors, and on such person becoming a member of the Company, the former member of the Company shall cease to be a member in respect of that assurance


Briefing - Write-up and Presentation (The Perfect Recommendation)

It is not possible to define a ‘perfect’ recommendation but there are some good and poor practices

Recommendations are not a science, and it is not possible to define a ‘perfect’ recommendation

Many individuals and organisations can tell you rules for writing recommendations, but these are still in part subjective

We can often recognise poor recommendations - by avoiding poor recommendations we are using good practice!


Briefing - Write-up and Presentation (Good Recommendation)

A good recommendation should:

Define what is to be achieved (but not how)

Be directly related to the accident

Be targeted against a single company for action

Identify the intention of the recommendation by adding a sentence– Prevent recurrence of the accident (or one of the causes)– Reduce the likelihood of recurrence– Reduce the consequences of such recurrence

Be referenced to the conclusions

Other good practices

Group recommendations under a heading

Do not omit recommendations on cost grounds alone


Briefing - Write-up and Presentation (Recommendations)

A considerable amount of resource is required to implement and track recommendations. It is therefore important that:

Recommendations address issues of a system nature rather than corrective actions (e.g. “requiring compliance with an existing standard” is a corrective action)

Recommendations from previous investigations are considered (in which case reference to the appropriate recommendation should be sufficient)

Recommendations made are really necessary


Briefing - Write-up and Presentation: Exercises

How can the following conclusions and recommendations be improved?

Conclusion - Communication between Control Room staff and operators leading up to the accident was not of the standard required for safety related issues. In particular, insufficient effort to identify the persons involved in each conversation, and their location, was apparent

Recommendation – Company X should introduce measures to remind all front line staff of the required standards for safety related communication




Conclusion - The requirement to maximise crude throughput caused Controller X to authorise the start-up of the Vacuum Distillation Unit before all the required safety procedures had been carried out

Recommendation – All oil companies should ensure that all staff involved in operations are re-briefed that whilst maximising crude throughput is important, the first concern of everyone must be safety, regardless of the impact on production




Conclusion – Company B’s priorities for worksite visits and audits did not identify this type of activity as a priority for management action

Recommendation – Company B should carry out an audit of contractors’ management and supervision of sub-contractors when used for pipeline painting work


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area

Introduction:

An incident occurred when the pump station sump pit overflowed into the surrounding area creating a significant pool of crude oil

The spill of product was due to a 1-inch drain line being left in the open position following the re-commissioning of the electrical driven Main Product Pump

The open valve is located on the pump suction



The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued)

Sequence of Events:

The electrical driven Main Product Pump was taken out of service at 0805 in order to clean the in-line pump suction strainer

Due to the large volumes of product that is required to be drained down to the pump station sump tank from the system, it was necessary to open several drain points in the pump suction and discharge piping and pump casing. The product is returned to the MOL suction line via the sump pump under level control

Following the re-installation of the pump suction strainer, the electric driven Main Product Pump was recommissioned at 1600. The gas turbine driven pump was shutdown at 1616

The shift on duty that afternoon consisted of:– Senior Operator– Field Operators x2– General Operator




Sequence of Events (continued):

While checking the pump station at 1730, the operator found product overflowing from the pump station pit. Product was flowing over the surrounding area

The operator found a drain valve had been left open on the pump piping, which he closed

The senior operator telephoned the Production Supervisor to report that a spill had occurred when pump sump pit overflowed as a result of leaving a drain valve open when the electric driven Main Oil Pump was re-commissioned

The Production Supervisor was not on duty or available at the time

At 1815 the Production Supervisor, based on the information given by the Senior Operator, advised that action would be taken to clean up the product spill the following day




Sequence of Events (continued):

Neither the Senior Operator nor the Production Supervisor called the Standby Production Supervisor or the Standby Safety Officer

The correct action in this situation would have been to inform the following:– The Duty Production Supervisor– The Standby Safety Officer– The Production Senior Duty Officer

At approximately 0200, the Security Officer who was patrolling the area noticed the product spill from the adjacent road and called the Standby Safety Officer

The Standby Safety Officer advised the Standby Production Supervisor




Conclusions:

The Operators who re-commissioned the pump failed to ensure that the pump and ancillary equipment was lined up correctly

Although the Senior Operator called the Production Supervisor, he did not take the correct actions as previously indicated

Although not on duty, the Production Supervisor demonstrated poor judgement, as well as failing to inform the Duty Production Supervisor. He did not appreciate the seriousness of the situation

Night Shift operators did not advise anybody, indicating that the pump station had not been visited




Recommended Corrective Actions:

1. Severe disciplinary action should be taken against the operators involved with the commissioning of the pump and for mal-operation of the process facilities and failing to follow procedures

2. A warning letter to be issued to the Production Supervisor for poor judgement and for failing to follow procedures

3. All incidents however minor in nature must be reported immediately and procedures strictly followed

4. All personnel must familiarise themselves completely with the emergency procedures

5. Incidents of this nature clearly demonstrate the requirement for Shift Production Supervisors at these types of facility




As a group discuss the Recommended Corrections Actions provided in the Case Study and complete the following activities utilising the Recommended Corrective Action Checklist

Were the Corrective Actions provided in the case study suitable?

Which ones do you consider unsuitable and why?

Propose Corrective Actions that are more suitable

Justify their suitability by utilising the Recommended Corrective Checklist

What areas in relation to the case study in your opinion need additional information and/or investigation?


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual



We suggest the following Conclusions

Immediate Cause– During the removal of isolations of Unit 300 a process operator did not shut the drain valve in

the feed line from Unit 27, which led to a release of 350kg of toxic process material and injury to another process operator during the re-commissioning of Unit 300

Underlying Causes– The Permit to Work did not identify the detail of the work to be carried out, had conflicting

dates and had not been ‘signed-on’ for the day of the accident– The handover between process shift teams did not accurately identify the status of Unit 300

and its isolations– The isolation valves for Unit 300 where not labelled– There was no risk assessment of the procedures for an isolation involving toxic process

material– There was a lack of communication within Ruhta Chemicals on when documented

procedures are required– The responsibility for the approving procedures within Ruhta Chemicals is not defined – Ruhtra Chemcials did not manage the involvement of contractors (including no adequate

process and no defined responsibilities) in the chemical clean of Unit 300


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Review of NPC Accident Investigation Report – Tondguyan Accident

Using your own knowledge and experience review the Tondguyanpetrochemical incident report that resulted in death and injury to operators during the start up of D1404 tankage following maintenance

Comment on the linkage between the accident description, findings and observations, cause of Accident and conclusions

Confirm whether it is possible to identify the events, conditions, casual factors and root causes of the accident using only the information provided in the report

Confirm whether it is possible to state the lessons learnt and what steps should be taken to ensure the same thing does not happen again based upon the information provided in the report

Comment on the suitability of the report and suggest any recommendations for improvement


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Review of NPC Emergency Response Manual – Emergency Planning

Using your own knowledge and experience, work in groups to review the NPC Emergency Response Planning requirements (Sections 1-9)

Comment on any identified strengths and weaknesses. Please support any comments with evidence/reference to the documentation provided

Consider how each of your respective complexes have addressed and implemented any requirements of this documentation


Review of NPC Emergency Response Manual – Emergency Simulations

Using your own knowledge and experience, work in groups to review the various emergency simulation assessment reports provided

Comment on any common identified strengths and weaknesses across all of the reports provided (Planning of the exercise, execution, assessment and reporting)

Consider the content and structure of the emergency simulation assessment reports – Are there clear linkages between the objectives set, assessment undertaken and

suggestions/recommendations made in the report. – Develop alternative observations, suggestions and recommendations based upon

the results of your assessment– Please support any comments with evidence/reference to the documentation

provided

Consider whether each of your respective complexes have developed emergency response procedures/plans (of the type described) for each of the major identified hazards onsite

Consider the strengths and weaknesses of developing detailed response procedures/plans for each potential incident vs more generalised emergency response procedures


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Revision of Key Course Learning Points

To summarise, the Accident Investigation Course has been structured in 6 sections covering each of the major phases of an investigation

The accident investigation process– Introduction to accident investigation and why effective accident investigation is

so important

Accident investigation tools and techniques– Introduction to various tools & techniques to support effective accident

investigation and identification of immediate and underlying causes

The process of evidence gathering– Description of the various types of evidence and consideration of which order

they should be collected

The contribution of human factors and safety culture– An introduction to human factors and safety culture and there importance in

accident investigation and development of effective recommendations



To summarise, the Accident Investigation Course has been structured in 6 sections covering each of the major phases of an investigation (continued)

The process of emergency management planning– An introduction into effective emergency response planning and crisis

management– Examples of how to assess the effectiveness of the emergency response during

the accident investigation process

The effective reporting of the accident investigation process– An introduction to a number of best practices that have been adopted in the

industry for the structuring of Accident Investigation Reports – Guidance on the presentation and language that should be used in the writing of

the reports



During this course we have also tried to recreate some of the stages of accident investigation and demonstrate “good and bad” accident investigation assessment through the various Case Study exercises

The BBC Piper Alpha video provides a very good introduction into how accidents develop and the fact that many accidents occur due to the failure of a numerous barriers

The ADL Case Study – Provides the opportunity for developing an accident investigation file, evidence

assessment, interpretation and conflict resolution– Interviewing exercise provides an opportunity for improving interviewing skills

such as questioning, listening, documenting and time management– Assessment of emergency response plans demonstrates the key linkages with

other site activities such as project planning, risk assessment and communication– Provides an opportunity for delegates to bring together all the evidence gathered

and develop reasoned arguments and well structured statements for the key sections of the accident investigation report

Individual case study exercises demonstrate the results of insufficient and/or poor accident investigation reports, both in terms of identification of root causes and inappropriate recommendations


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Revision of Past Major Accidents - Seveso

A dense vapour cloud containing tetrachlorodibenzoparadioxin (TCDD) was released from the reactor of a chemical plant manufacturing pesticides and herbicides in 1976. The poisonous vapour contaminated some ten square miles of land and vegetation. More than 600 people had to be evacuated and 2,000 were treated for dioxin poisoning

Key lessons learnt from Seveso

Public control of major hazard installations Inherently safer design of chemical processes

Siting of major hazard installations Control and protection of chemical reactors

Acquisition of companies operating hazardous processes

Adherence to operating procedures

Hazard of ultratoxic substances Planning for emergencies

Hazard of undetected exotherms Difficulties of decontamination

Hazard of prolonged holding of reaction mass


Key Lessons Learnt From Major Accidents - Piper Alpha

In July 1988, an explosion on the Piper Alpha oil rig in the North Sea resulted in a fire that completely destroyed the platform,and cost 167 lives and millions of dollars a day in lostrevenue

Key lessons learnt from Piper Alpha

Regulatory control of offshore installations Offshore installations; limitation of inventory on installation and in its pipelines

Quality of safety management Offshore installations; emergency shut-down system

Safety management system Offshore installations; fire and explosion protection

Documentation of plant Offshore installations; temporary safe refuge

Fallback states in plant operations Offshore installations; limitation of exposure of personnel

Permit-to-work systems Offshore installations; formal safety assessment

Isolation of plant for maintenance Offshore installations; safety case

Training of contractors’ personnel Offshore installations; use of wind tunnel tests and explosion simulations in design

Disabling of protective equipment by explosion itself The explosion and fire phenomena

Onshore installations; control of pressure systems for hydrocarbons at high pressure

Publication of reports in accident investigation


Key Lessons Learnt From Major Accidents - Flixborough

In June 1974, a vapour cloud explosion destroyed thenypro cyclohexane oxidation plant at Flixborough,England killing 28 people. Other plants on the site wereseriously damaged or destroyed

Key lessons learnt from Flixborough

Public controls of major hazard installations Limitation of exposure of personnel

Siting of major hazard installations Design and location of control rooms and other buildings

Licensing of storage of hazardous materials Control and instrumental of plant

Regulations for pressure vessels and systems Decision making under operational stress

The management system for major hazard installations Restart of plant after discovery of a defect

Relative priority of safety and production Security of and control of access to plant

Use of standards and codes of practice Planning for emergencies

Limitation of inventory in the plant The metallurgical phenomena

Engineering of plants for high reliability Vapour cloud explosions

Dependability of utilities Investigation of disasters and feedback of information on technical incidents


Key Lessons Learnt From Major Accidents - Longford

In September 1998 an explosion and fire at the Longford gas plant in Australia tragically killed two men and injured eight workers. The explosion resulted in a two-week gas supply shutdown

Key lessons learnt from Longford

Front-line operators must be provided with appropriate supervision and backup from technical experts

Procedures for identifying hazards should be developed

Improvement of emergency shutdown procedures and process monitoring

Alarm systems must be carefully designed so that warnings of trouble do not get dismissed as normal

Increased training for operators in dealing with abnormal conditions

Reliance on lost-time injury data in major hazard industries is itself a major hazard

Regular reviews of company standards, practice and policies

Auditing must be good enough to identify the bad news and to ensure that it gets to the top


Key Lessons Learnt From Major Accidents - Bhopal

In December 1984, gas leaked from a tank of methyl isocyanate (MIC) at a plant in Bhopal, India. The following morning over 2,000 people were dead and 300,000 injured. At least 7,000 animals perished

Key lessons learnt from Bhopal

Public control of major hazard installations Limitation of inventory in the plant

Siting of and development control at major hazard installations

Set pressure of relief devices

Management of major hazard installations Disabling of protective systems

Highly toxic substances Maintenance of plant equipment and instrumentation

Runaway reaction in storage Isolation procedures for maintenance

Water hazard in plants Control of plant and process modifications

Relative hazard of materials in process and in storage Information for authorities and public

Relative priority of safety and production Planning for emergencies


Contents


Gathering Part 1


Briefing -Evidence

Gathering Part 2



HumanFactors




Management




Process


Disaster’



Study 1

Day 4Briefing –




Summary of Day 3



Day 5 Test

Summary of Day 1

Summary of Day 2



Management Planning



Accidents


Learning Points


Reports


Manual


Accident Investigation Test

accident investigation workbook presenting

Documents