Accident Investigation Workbook Presenting

Effective Accident Investigation for the Process Industries
WORKBOOK June 2005

Arthur D. Little Limited
NPC/20365/142_Accident Investigation Workbook.ppt
Introduction - Venue Arrangements
Fire Alarm, Test and Evacuation
Welfare Facilities
Breaks and Refreshments
Messages and Mobile Phones
Introduction - Objectives
This five-day accident investigation training course has eight primary units and includes some NPC specific elements:
Understanding the purpose of accident investigation Introduction to four basic investigation tools/models Evidence gathering Understanding human factors Understanding the different needs of various stakeholders involved in the accident investigation process Writing the report Emergency Management Planning Key learning points from past Major Accidents NPA Case Materials One additional accident reporting case study Additional case study on Emergency Response Planning
Introduction - Objectives
This training course has not been developed as a specific accident investigation procedure, but to provide an introduction to tools and techniques that will facilitate effective accident investigation
The four basic investigation tools/models provide a framework around which to structure and undertake the investigation The section on evidence is structured around the types of evidence that should be considered and the priority in which evidence should be gathered. It does not specify how evidence should be collected, analysed and recorded Human factors is becoming a much more important part of accident investigation and third party company prosecution. This training course provides a brief introduction to Human Factors and various techniques for analysing personnel behaviour Emergency Management Planning focuses on various key aspects of emergency planning and response management based upon industry best practice and lessons learnt from past accidents
Introduction
This training course is one of a number of services provided internationally to the process industries
Arthur D. Little provides a range of safety and environmental services to high hazard industries internationally, including oil and gas processing, oil and gas exploration and transportation, and passenger and freight transportation Our safety and environmental services include: Independent auditing Risk assessment Due diligence Accident investigation Independent assessment Management training Management system development
This training course is based on our training course for rail accident investigators and is tutored by process industry safety experts
Introduction
What I need from this Effective Accident Investigation training course is:
Introduction
The overall structure of the training course:
Day 1
Introduction
Briefing Why investigate accidents?
Briefing The Investigation Process
Video Piper Alpha Spiral to Disaster
Briefing - Tools and Techniques
Individual Case Study 1
Day 2
Summary of Day 1
ADL Case Study Part 1a
Briefing Evidence Gathering Part 1
ADL Case Study Part 1b
ADL Case Study Part 2
Day 3
Summary of Day 2
Briefing Introduction to Human Factors
Briefing Introduction to Safety Culture
Briefing Interface Management
Briefing Emergency Management Planning
Day 4
Summary of Day 3
Briefing Write-up and Presentation
Review of ADL Case Study & Conclusions
Day 5
Review of NPC Investigation Reports
Review of NPC Emergency Response Manual
Revision of Key Course Learning Points
Review of Past Major Accidents
Test
10
Introduction - Timetable
The time-table for Day 1 is:
Time 08.30 09.00 10.00 10.30 11.30 12.00 13.30 15.00 15.30 16.00 17.00
Session Welcome and Introduction Briefing - Why Investigate Accidents? BREAK Briefing - The Investigation Process Video Piper Alpha Spiral to Disaster LUNCH Briefing and Class Exercise Tools and Techniques BREAK Briefing and Class Exercise Tools and Techniques Individual Case Study 1 END OF DAY 1
11
Time 08.30 09.00 10.00 10.30 11.00 12.00 13.30 15.00 15.30 17.00 Review of Day 1
Session
ADL Case Study Part 1a BREAK Briefing Evidence Gathering Part 1 ADL Case Study Part 1b LUNCH Briefing Evidence Gathering Part 2 BREAK ADL Case Study Part 2 END OF DAY 2
12
Time 08.30 09.00 10.00 10.30 11.15 12.00 13.30 14.15 15.00 15.30 16.15 17.00 Review of Day 2
Session
Briefing Introduction to Human Factors BREAK Briefing Introduction to Safety Culture Briefing Interface Management LUNCH Individual Case Study 2 Briefing Emergency Management Planning BREAK Briefing Emergency Management Planning ADL Case Study Part 3 END OF DAY 3
13
Time 08.30 09.00 10.00 10.30 11.00 12.00 13.30 15.00 15.30 17.00 Review of Day 3
Session
Briefing Write-up and Presentation BREAK Individual Case Study 3 ADL Case Study Part 4a LUNCH ADL Case Study Part 4b BREAK Review of ADL Case Study and Conclusions END OF DAY 4
14
Time 08.30 10.00 10.30 12.00 13.30 14.15 15.00 15.30 17.00
Session Review of NPC Investigation Reports BREAK Review of NPC Emergency Response Manual LUNCH Revision of Key Course Learning Points Review of Major Past Accidents BREAK Test CLOSE
15
16
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
17
18
Briefing Why Investigate Accidents?
The factors for and against improved safety
Continuing efforts to improve safety performance Improved Defences Accident Investigation/Reporting Enhanced Safety Management Unsafe Act Auditing Safety Management Systems etc.
Accident Frequency
Accident producing factors Creeping Entropy Murphys Law Normalisation Routinisation Intrinsic Hazards
FOR AGAINST Time
19
Briefing Why Investigate Accidents?
The factors against improved safety defined
Creeping entropy: No system or organisation remains static. Its components gradually wear out and variability increases. People begin to take each other for granted Murphys Law: No matter how well defended the system, or how remote the hazards, someone will find a way of defeating the protective measures. If something can go wrong, it will go wrong Normalisation: This describes the process of forgetting to be afraid. People exposed to fairly fixed and known risks over lengthy periods of time come to under-estimate them Routinisation: Activities within a well-established system become routine. At an individual level, this means that people become skilled and practised at their jobs. The ability to perform recurrent tasks, more or less automatically, liberates conscious attention for other matters. However, this, in turn, can lead to its capture by things unrelated to the task in hand. Habit is thus a mixed blessing. Limited attention capacity is released for more strategic concerns, but the person is also rendered more susceptible to absentminded slips and lapses. Such errors are the hallmark of the practised performer Intrinsic hazards: No matter how well defended the system, hazards do not disappear. They too are subject to unpredictable local variations
20
Briefing - Why Investigate Accidents?
The need for effective accident investigation is driven by legal, economic and human considerations
LEGAL ECONOMIC HUMAN
Need for Effective Accident Investigation
21
There is a legal requirement in many countries for organisations to investigate accidents - for example in the UK
Health and Safety Health and Safety at Work etc. Act 1974 at Work etc. Act 1974
Management of Management of Health and Health and Safety at Work Safety at Work Regulations Regulations The Reporting of The Reporting of Injuries, Diseases and Injuries, Diseases and Dangerous Occurrences Dangerous Occurrences Regulations Regulations The Construction The Construction (Design & (Design & Management) Management) Regulations Regulations
Control of Control of Major Accident Major Accident Hazards Regulations Hazards Regulations
Safety Cases
ABC Company Standards
XYZ Company Standards
etc
22
Major accidents have driven the development of national and international regulations
1974 Flixborough explosion (28 fatalities) In UK Health and Safety at Work etc Act 1974 1976 Seveso dioxin release (700 major injuries) European Union Seveso Directive that led in UK to Control of Industrial Major Accident Hazards (CIMAH) Regulations 1984 1985 Bhopal toxic gas release revision to threshold inventory levels for methyl isocyanate 1988 Piper Alpha disaster (167 fatalities) In UK Offshore Safety Case Regulations 1994 1999 Longford Gas Explosion (2 fatalities) In Australia Major Hazard Facility Regulations
23
Recent research commissioned by the Health and Safety Executive in the UK shows that in many organisations accident investigation is not adequate
The research (Accident Investigation - The drivers, methods and outcomes, HSE 2001) involved interviews with 100 organisations across a range of sectors, following a telephone survey of 1500 organisations Key findings include: Failure to discriminate, or indeed understand, the distinction between immediate and underlying causes Organisations often overestimate the quality of their investigations Lack of formal systems to ensure recommendations are acted upon Lack of training in accident investigation
24
The potential impact of major accidents on the profit and loss of an organisation can be significant
6
Exxon's net profits
$ bn
Loss of Exxon profits associated with the Valdez accident in Prince William Sound, Alaska 24.03.89
0 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993
25
Accidents can significantly affect business performance and lead to action against individual Directors
Following the UK rail accident at Hatfield, the Railtrack share price collapsed and the UK Government intervened
26
Even a relatively small accident can have a significant impact on the profit and loss of an organisation
Vehicle impact with above ground pipeline
IRR 300,000,000
Direct Costs Repair to Vehicle Repair to Pipeline
Accident
Indirect Costs Management Time Compensation Claims Increased Insurance Costs Business Interruption Loss of Good Will
Using Health and Safety Executive research, the indirect cost of accidents are 6-10 times the direct costs
IRR 2, 700,000,000
Total IRR 3,000,000,000Total Costs
27
The knock on impact for revenue generation can be sizeable
Total Cost
IRR 300,000,000
Revenue to Cover Costs
IRR 60m
Profit Margin
5%
How easily can your business generate this extra revenue?

28
There are human/ethical reasons to investigate accidents
Lessons from Longford Things happened on that day that no one had seen at Longford before. A steel cylinder sprang a leak that let liquid hydrocarbon spill onto the ground. A dribble at first, but then, over the course of the morning it developed into a cascade Ice formed on pipework that normally was too hot to touch. Pumps that never stopped, ceased flowing and refused to start. Storage tank liquid levels that were normally stable plummeted I was in Control Room One when the first explosion ripped apart a 14-tonne steel vessel, 25 metres from where I was standing. It sent shards of steel, dust, debris and liquid hydrocarbon into the atmosphere (The Age, 30/9/99). These are the words of an operator involved in the accident ESSOs gas plant at Longford, Victoria on 25 September 1998, an accident which killed two men, injured eight others and cut Melbournes gas supply for two weeks.
29
30
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
31
32
Briefing The Investigation Process (Type of Investigation)
A typical sequence for accidents and investigations
Accident Accident
Emergency Emergency Response Response Evidence Evidence Gathering Gathering Immediate Immediate Investigation Investigation Formal Formal Investigation Investigation
Report Report
Report Report
The decision on the need for a formal investigation should be primarily based on the potential accident consequences and the opportunity to learn lessons
33
The decision on the need for a formal investigation should be primarily based on the potential consequences and the opportunity to learn lessons
CONSIDER FORMAL INVESTIGATION

Opportunity to Learn Lessons
FORMAL INVESTIGATION
Other factors that might affect Other factors that might affect the need for a formal the need for a formal investigation investigation Criminal investigation Criminal investigation Safety regulator investigation Safety regulator investigation
ONLY IMMEDIATE INVESTIGATION
CONSIDER FORMAL INVESTIGATION
National/international media National/international media interest interest Political interest Political interest
Low
Potential Consequences
High
Potential consequences can be in the areas of safety, health, environmental impact, financial, business reputation and political
34
Briefing - The Investigation Process (Type of Investigation)
What is a formal investigation?
Formal Investigation Key Characteristics

Defined Terms of Reference Defined Investigation Team and Leader Sufficient independence from line management Access to people and resources to enable effective investigation Production of a well-structured report Review to ensure Terms of Reference are achieved
35
Some petroleum companies use a semi quantitative process to determine the incident category and level of investigation required
INCREASING PROBABILITY
Potential Severity People Asset/Production Environment Reputation A Never Heard of in industry B Has occurred in industry C Has occurred in NPC D Occurs several times a year in NPC E Occurs several times a year at this site Analysis level
Slight injury First Aid or medical treatment Minor injury LWA 4 days or less RWC Major injury (LTA, PPD < 4 days) Single fatality
Slight Damage, no disruption to operation Minor Damage (<$1,000,000 / or brief disruption) Local Damage ($110,000,000)
Slight Effect
Slight Impact (public awareness) Limited Impact (local public media) National Impact (extensive adverse media) Regional Impact (extensive adverse media) International Impact (extensive adverse media)
LOW
SUMMARY ANALYSIS
Minor Effect
MEDIUM
SUMMARY ANALYSIS
INCREASING SEVERITY
Localised Effect
HIGH
Major Damage ($10100,000,000 / partial operation loss) Extensive Damage (>$100,000,000 / & substantial operation loss)
Major Effect
Multiple fatalities
Massive Effect
INTOLERABLE
36
Briefing - The Investigation Process (Principal Objectives)
There are four principal objectives of a formal investigation. The Manager commissioning the investigation sets the Terms of Reference so that these objectives can be met
Principal Objectives To establish the facts To determine the immediate causes of the accident To determine the underlying causes of the accident To develop robust recommendations
Terms of Reference
The Manager commissioning the investigation shall agree the Terms of Reference with the investigation leader
37
Good practice in setting the Terms of Reference
Terms of Reference
The Terms of Reference should state: The type of investigation being undertaken The name of the investigation leader The names of the investigation team That the purpose is to establish the full facts, identify the immediate and underlying causes so as to permit identification of actions that would prevent, reduce the risk of, and/or mitigate the consequences of recurrence of the accident/incident The requirement to make relevant recommendations to prevent, or reduce the risk of recurrence of the accident/incident, and mitigate the consequences should a recurrence take place To whom such recommendations may be addressed The timescales for commencement and completion of the investigation and for issue of the report
38
Before proceeding, we will further develop our understanding of immediate and underlying causes and then focus on analysis techniques that will allow us to uncover the underlying causes of an accident
Principal Objectives To establish the facts To determine the immediate cause(s) of the accident To determine the underlying cause(s) of the accident To develop robust recommendations
Conclusions Immediate Cause(s) ? Underlying Cause(s) ?
39
Briefing - The Investigation Process (Immediate and Underlying Causes)
Before describing some of these causal analysis techniques it is important we understand the principles behind the terms immediate cause(s) and underlying cause(s)
What? How? When? Where? Who?
Immediate Causes Accident
Why? Why? Underlying Causes Why? Why?
The immediate cause(s) is an unsafe act or unsafe condition which causes an accident or incident Underlying cause(s) are any factors which led to the immediate cause(s) of accidents or incidents, or resulted in such causes not being identified and mitigated
40
Briefing - The Investigation Process (Active and Latent Failures)
Active and latent failures
An accident is the product of a long chain of events. Unsafe acts, active failures, are often seen as the most important part of the accident story. However, the story began much earlier and involved many different aspects of the organisation. The stage had already been set for the accident by the presence of latent failures. These are either human or technical failures that lie in wait within the system, often for long periods. Unsafe acts are frequent, but only a few have bad consequences. It is very hard to predict in advance exactly which unsafe acts will lead to an accident, but latent failures can be revealed long before any accident occurs.
Source: Shell TRIPOD Manual

41
42
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
43
44
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
45
46
Briefing and Class Exercise Tools and Techniques (Causal Analysis Techniques)
There are many causal analysis techniques that can be applied to accident investigation. A few of the more common types of technique are:
Analysis of events can be useful in identifying and understanding the events that culminated in the accident Barrier/Defence identification and analysis is used to identify the failures which led to the accident Checklist Analysis is helpful in exploring different aspects of the accident Unstructured methods are used to link ideas, usually at the start of an investigation
Whatever the technique, the reason it is used is to determine - How, what, when, where, who and why did it happen?
47
Briefing and Class Exercise Tools and Techniques (Analysis of Events)
Analysis of events can be useful in identifying and understanding the events that culminated in the accident e.g. Events and Causal Factor Charting (Source US Dept of Energy)
Root Causes
Root Causes Are determined after all the significant events and conditions have been determined Causal Factors Are reasons why condition existed for the event to occur Conditions Are passive e.g. low light illumination in the area Describe states or circumstances rather than occurrences As practical should be quantified Should indicate date and time if practicable/applicable Are associated with the corresponding event
Why? Why? Why? Why? What? How? When?
Causal Factor
Condition
Where? Who?
Condition
Condition
Event 1
Event 2
Event 3
Accident Event
Events Are active Ideally should be stated using one noun and one active verb Should be quantified where possible e.g. the worker fell 10m Should indicate the date and time of event, when known Should be part of the accident sequence and linked to the event or events and conditions immediately preceding it
48
Briefing and Class Exercise Tools and Techniques (Event and Causal Analysis - Example)
Class Exercise: Using the information given below (typical of the information you would have at the time the investigation team arrives on site) to start the event and causal analysis technique
Accident Description This accident occurred following an acid sampling procedure. At the moment all you have heard is: example At approximately 22:30 a process operator collected a Work Instruction to take an acid sample from the Pump A circuit. When the sample valve on Pump B circuit was opened there was an acid leak. The process operator had to be taken to hospital with chemical burns.
Determine just the events and how they are linked for the above accident
Note:Normally for this exercise the investigation team would use removable notes to depict the events and conditions that affected the events chronologically
49
Briefing and Class Exercise Tools and Techniques (Event and Causal Analysis)
Class Exercise:
50
Class Exercise: Potential Solution
Process operator Process operator collects Work collects Work Instruction to take Instruction to take acid sample acid sample
Process operator Process operator opens sample opens sample valve in B pump valve in B pump circuit circuit
Acid Leak Acid Leak
Process operator Process operator taken to hospital taken to hospital with chemical with chemical burns burns
51
Briefing and Class Exercise Tools and Techniques (Events and Causal Analysis)
Class Exercise (continued): Revise the events and causal analysis chart using the additional information given below
Information obtained from an onsite visit and further research has revealed: Process operator stated that he shut off Pump A locally and cancelled the local pumpstop alarm The process operator indicated it was difficult to read the Pump A/B labels because of poor lighting It took over 1 hour for the injured process operator to reach the nearby hospital Use the information above to start to update the information on your first suggested solution, and begin to determine what conditions contributed to the events
52
Class Exercise:
53
Lighting made it difficult to Read A/B labels Process operator collects Work Instruction to take acid sample Process operator opens sample valve in B pump circuit
It took one hour to reach local hospital
Process operator shuts off Pump A locally
Process operator cancels local alarm
Acid Leak
Process operator taken to hospital with chemical burns
54
Briefing and Class Exercise Tools and Techniques (Events and Causal Analysis)
Class Exercise (continued): Continue to develop the events and causal analysis chart using the additional information given below Information obtained following a review of the facts and conditions, documentary evidence and interviews indicated:
It was found that the Pump A/B labels were old, dirty and damaged The process operator had been on holiday the week before and this was his first shift back The process operator had not used this sample point for 6 months prior to the accident The A and B pumps appear to be identical The Rescue Team had used a mobile phone to call an ambulance directly, rather than using the dedicated radio to the ambulance control. The ambulance control did not realise the priority of the call or the specific location to attend. This delayed the ambulance arriving at the accident location
55
Class Exercise:
56

Operator had been on holiday week before Operator had not used this sample point for 6 months Delay due to use of mobile phone by Rescue Team
A/B labels were old, dirty and damaged
A and B pumps appear identical
Lighting made it difficult to read A/B labels Process operator opens sample valve in B pump circuit
It took one hour to reach local hospital
Process operator collects Work Instruction to take acid sample
Process operator shuts off A pump
Process operator cancels local alarm
Acid Leak
Process operator taken to hospital with chemical burns
From this diagram, can you suggest what might be the underlying cause(s) of the accident?
57
Briefing and Class Exercise Tools and Techniques (Barrier Analysis)
Barrier/Defence identification and analysis is used to identify the failures which led to the accident
Hazard
Barrier
Target
Hazards are energy sources, materials conditions, etc that have the potential to cause injury or loss
A barrier is any means used to control, prevent or impede the hazard from reaching the target
A target is a person or object that a hazard may damage, injure or harm
58
A barrier is any means used to control, prevent or impede the hazard from reaching the target
Two types of barriers exist: Physical Barriers and Management Barriers
Barrier Analysis addresses Barriers that were in place and how they performed Barriers that were in place but not used Barriers that were not in place but required The barrier(s) that, if present or strengthened, would prevent the same or a similar accident from occurring in the future
Manhole
Physical Barriers e.g. Conduits Equipment and Engineering Design Fences Guard Rails Masonry Protective Clothing Safety Devices Shields Warning Devices Management Barriers e.g. Hazard Analysis Knowledge/Skills Supervision Training Work Planning Work Procedures
59
The basic Barrier Analysis is completed in five steps (e.g. for a simple electrocution accident)
Step 1: Identify the hazard and the target. Record them at the top of the worksheet e.g. electrical cable hazard, man - target Step 2: Identify each barrier. Record in column one. e.g.Engineering drawings showing position of cable" Step 3: Identify how the barrier performed. (What was the barrier's purpose? Was the barrier in place or not in place? Did the barrier fail? Was the barrier used if it was in place?) Record in column two. Drawings were incomplete and did not identify cable" Step 4: Identify and consider probable causes of the barrier failure. Record in column three. "Engineering drawings and construction specifications were not updated" Step 5: Evaluate the consequences of the failure in this accident. Record evaluation in column four. "Existence of electrical cable unknown"
Hazard e.g. Electrical Cable Barriers? How did each barrier perform? Drawings were incomplete and did not identify cable Target e.g. Man Why did barrier fail? Engineering drawings and construction specifications were not updated How did each barrier affect accident? Existence of electrical cable unknown
Engineering drawings showing position of cable
60
Briefing and Class Exercise Tools and Techniques (Barrier Analysis - Example)
Class Exercise: Using all the information given about the acid leak, brainstorm the likely barriers that were not in place, unused or failed
61
Briefing and Class Exercise Tools and Techniques (Barrier Analysis - Example)
For the acid leak it is useful (although not essential) to consider two targets
Acid
Design of containment systems Maintenance of containment systems
The Environment
Acid Sampling
Work instruction Labelling of equipment Local pump alarms Operator training and PPE
Process Operator
Each barrier would then be analysed to determine how it performed during the accident
62
Barrier analysis, and accident causation sequences, form the basis of the Shell TRIPOD analysis
Fallible decisions Latent failures Preconditions Unsafe acts System defences
Causal sequence
Accident Limited windows of accident

63
The Shell TRIPOD technique looks at unsafe conditions and underlying causes
TRIPOD is concerned with strengthening safety management rather than treating symptoms of unsafety TRIPOD research has established latent failures can be categorised into 11 General Failure Types: Hardware Design Maintenance Management Procedures Error-enforcing conditions Housekeeping Incompatible goals Commercialisation Organisation Training Defences
64
The Change Analysis technique is a variation of the Barrier Analysis technique

Change is one of the most common contributing factors to unsafe conditions and major accidents When a system is perturbed by change there is a greater potential for errors, loss of control, and incidents Change can be sudden and dramatic, or gradual and difficult to detect. Changes in incident causation can be singular or multiple (often the case), and invariably additive and synergistic in their effects
65
The Change Analysis technique is ideal for brainstorming what has changed since conditions were safe (or perceived as safe)
Change Analysis looks at a problem by analysing the deviation between what is expected and what actually happened. The Investigator asks what occurred to make the outcome of the task or activity different from all other times this task or activity was successfully completed Change Analysis is a good technique to use whenever the cause of the condition are obscure, you do not know where to start, or you suspect a change may have contributed to the condition Not recognising the compounding of change (e.g. a change made 5 years previously combined with a change made recently) is a potential shortcoming of Change Analysis Not recognising the introduction of gradual change as compared with immediate change is also possible
66
Change analysis is ideal for brainstorming about what has changed since conditions were safe (or perceived as safe)
When to use: When cause is obscure. Especially useful in evaluating equipment failures. This technique may be adequate to determine root cause of a relatively simple condition Advantages: Simple 6 step process Disadvantages: Limited value because of the danger of accepting wrong obvious answer. A singular problem technique that can be used in support of a larger investigation. It is not thorough enough to determine all of the causes for more complex conditions as all root causes may not be identified
67
The six steps involved in Change Analysis are as follows:
Change Analysis
1 Incident with Incident with undesirable undesirable consequences consequences 4 Set down Set down differences differences 5 Analyse differences Analyse differences for effect on for effect on undesirable undesirable consequences consequences
Compare Compare
Comparable incident Comparable incident without undesirable without undesirable consequences consequences
Integrate information Integrate information relevant to the causes relevant to the causes of the undesirable of the undesirable consequences consequences 6
68
The six steps involved in Change Analysis are as follows:
1. Describe the activity with the Undesirable Consequences 2. Describe a comparable activity without Undesirable Consequences 3. Compare the two to detect all differences 4. Write down all of the detected differences or distinctions that set the accident
activity situation apart from the safe activity situation whether they appear to be relevant or not determine their effects on the incident. Give compounding or synergistic interacting of changes that increase their effects on incident Consequences confirmation, validation and clearer understanding of incident occurrence and prevention
5. Analyse the differences and distinctions to identify underlying changes, and to
6. Integrate change analysis results with those of other analytical methods for
69
Change Analysis Worksheet

Involvement Factors A. Incident Situation B. Comparable Safe Condition C. D. What Is Distinctive About What Has Changed A In/About C
1. Who Workers Supervisors Management Others 2. What Object Energy Environment Barriers 3. Where Location On The Object In The Process 4. When In Time In The Process 5. Extent How Bad Trend 6. Management Control Control Chain Monitoring
70
Briefing and Class Exercise Tools and Techniques (Checklist Analysis)
Checklist Analysis is helpful in exploring different aspects of the accident - for example three common human factors classifications
Personal factors
Job factors
Person(s)
Job
Organisational and Management factors
Organisation and management
71
Briefing and Class Exercise Tools and Techniques (Checklist Techniques - Example)
Checklist Analysis is helpful in exploring different aspects of the acid leak
Person(s)
Process operator back from holiday Process operator experience/ ability? Under stress?
Job
Pumps A and B are identical Labels difficult to see (condition/ lighting)
Organisation and management

Regular Safety Inspections carried out? System failed to pick up operator familiarity issue Training Regular maintenance of lighting and labels
72
Briefing and Class Exercise Tools and Techniques (Unstructured Techniques)
Unstructured methods are used to link ideas, usually at the start of an investigation
Time delay for emergency Response Comms Maintenance team Physical limitations
Keep fit? Tired
Acid leak Investigation
Auto-pilot Safety Regulator Operations Shift Team Holiday effect Process Operator
Positioning, Maintenance of lighting and labels
Site Investigation Pump controls
Witness
Positioning of people
73
Briefing and Class Exercise Tools and Techniques (Causal Analysis - Summary)
To summarise, there are a variety of causal analysis techniques that can be used to assist the investigator
Causal Analysis Technique Event and Causal Analysis When is the technique useful? Useful in: Illustrating and validating the sequence of events leading to the accident and the conditions affecting these events Showing the relationship of immediately relevant events Providing an on-going method for organising and presenting data Clearly presenting information regarding the accident that can be used to guide report writing Providing an effective visual aid that summarises key information regarding the accident and its causes in the investigation report Barrier/Defence/Change Techniques Useful in: Ensuring that all failed, unused, or uninstalled barriers are identified Understanding the impact barrier has on an accident Checklist Techniques Unstructured Techniques Useful in: Formulating questions Useful: At the beginning of the investigation when information can be limited
74
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
75
76
Individual Exercise Case Study 1
Some information on a loss of containment incident
On the 24 September at 1010, 16-PIA-100L cooling water header low, pressure alarm was activated on NGL-1 control panel. The panel operator confirmed that both P-1618 B&C cooling water pumps were running as the running indicator was still illuminated. P-3001 A/B also indicated OK running status Further checks showed that 16-MOV-100 on the on line cooling water filter S-1602A was shut. An open signal to 16-MOV-101 on standby cooling water filter S-1602B was given from the control room An operator was sent to site to check/open the tripped MOV or bypass the filter as required The Pressure in C-1302 Depropaniser Column increased rapidly to 19.8 barg, this confirmed the loss of cooling water 13-PRC-5-1 Depropaniser Column pressure control valve was fully open
77
Some information on a loss of containment incident (continued)
It was believed that 13-RV-10 C-1302 overheads relief valve had lifted Due to the rapid rise in pressure it was deemed necessary to open the 13-HC-05 the C-1302 depressurising valve The operator in the plant reported a huge noise but no gas cloud could be observed Initially it was felt that the sound was due to the depressurisation of C-1302. It was hard to identify the source of the leak as the sound persisted, and the difficulty of the location The Senior Operator identified the leak as coming from a vent line near E-1304D that had failed The fire alarm was then actuated and the plant furnace and turbine were shutdown immediately
78
Some information on a loss of containment incident (continued)
It was found that the nipple of the vent on E-1304D had sheered off possibly due to the structure/piping vibrations resultant from the opening of 13-RV-10 and 13-HC05 The plant was restarted on reduced feed and the vent nipple on E-1304D was replaced and the condenser commissioned and the plant normalised. 16-MOV100/101 was kept on local mode On visual inspection it was noticed that a number of pipe clamp securing bolts were sheared off Probable causes: Loss of cooling water to NGL 1, due to the closure of the cooling water inlet valve 16-MOV-100 16-MOV-100 closing was due to a short circuit in the control cable
79
For this loss of containment incident complete the following tasks individually
Identify the Actual Consequences Identify the Potential Consequences Using the semi-quantitative process in slide 36 assess the potential of the event in relation to PEOPLE ASSETS/PRODUCTION ENVIRONMENT and REPUTATION by providing value (1-5) for each Identify what level of investigation you would recommend. Give your reasons why
80
Suggested solution
PEOPLE ACTUAL CONSEQUENCE POTENTIAL CONSEQUENCE N/A
ASSET / PRODUCTION 2
ENVIRONMENT 1-2
REPUTATION N/A
4-5
3-4
4-5
Based upon the POTENTIAL CONSEQUENCES, recommend DETAILED FORMAL INVESTIGATION
81
82
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
83
84
Suggested solution Events and Causal Factors Chart
Plant Isolation
Weekend Cleaning Maintenance
Blue Shift On
TT/CS Handover 0700
12 Feed Unit 27 0815
Unit 300 Valve Open
Leak
TT Reports Noise 0852
Emergency Response 0900
Line Isolation 0925
Hospital
85
Suggested solution - Barrier Analysis
Physical
Double Block and Bleed Isolation Emergency Response
Management Systems
Procedures Handover Process Training
86
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
87
88
Briefing - Evidence Gathering
This section (split into two parts) looks at the gathering of physical and human evidence which form the basis of effective accident investigation
Site investigation Prioritising evidence Correlating evidence Cause or effect Conducting interviews (Part 2)
Without evidence there cannot be an investigation!

89
Briefing - Evidence Gathering (Purpose of Site Investigation)
The purpose of the site investigation is to establish what happened and begin the process of understanding why the accident/incident took place/occurred
What happened?
Building the Picture Obtaining a clear understanding of factors, actions and circumstances at the time of the accident/incident (immediate cause)
Why? Understanding Identifying the underlying causes that created the conditions for the accident/incident to occur
90
Briefing - Evidence Gathering (Initial Assessment)
The Investigation Leader needs to plan the investigation and have clear objectives based on an initial assessment of the event
What Happened? What Happened? Where Did the Event Where Did the Event Take Place? Take Place? What Was Involved? What Was Involved? Who Was Involved? Who Was Involved? What Is the Extent of What Is the Extent of the Site or Affected the Site or Affected Area?the What Were the Area? What Were Consequences? Consequences? Why Did it Happen? Why Did it Happen? What Resources Are What Resources Are Needed to Needed to investigate? investigate?
If there is a delay in appointing an Investigation Leader, then the Incident Commander must take on this role
91
Briefing - Evidence Gathering (Information Gathering)
It is a responsibility of the Incident Commander to ensure a current record is maintained of all evidence gathered and actions taken
Statements/reports From persons involved and witnesses
Relevant records
Shift log book, defect records, maintenance records Recorded time when the accident/incident occurred. Also the times of other relevant events and when evidence was collected Technical examinations or tests on equipment Audio or visual recordings together with photographs, sketches and notes both on and off site together with other relevant information Control panel indications and alarms
Time Results of examinations Photos, sketches, recordings Control equipment
Data recorders
Downloading data recorders or extracting data from control equipment Control room/operator communications, actual messages and channels in use
Communications
92
Briefing - Evidence Gathering (Basic Techniques and Equipment)
There are a number of ways to record evidence at the site quickly and accurately and best results are obtained by combining several techniques
Sketches
Notes
Photographs
Video Film
Sample Collection
Tape Recorders
Measuring Equipment
93
Briefing - Evidence Gathering (Prioritising Evidence)
Site evidence needs to be categorised and top priority given to recording and gathering perishable evidence
Available evidence
Retrievable evidence
Perishable evidence
94
Briefing - Evidence Gathering (Prioritising Evidence)
Major factors affecting the recording and gathering of perishable evidence are elapsed time and the recovery and restoration activities
Elapsed time Clearance or recovery operations
95
Briefing - Evidence Gathering (Examples)
Examples of types of evidence
Perishable Weather conditions Human memory Equipment positions Retrievable Equipment components (if labelled/preserved initially) Maintenance records Medical and training records Control system data Available Local, national and international maps Legislation Company and international standards
96
Briefing - Evidence Gathering (Correlating Evidence)
Cross-checking or correlating the evidence with other evidence is a necessary part of the investigation process
examples
Correlation of damaged pipe racks and pipes with Control Room records showing flow data can indicate which pipes failed initially Blood stains can indicate where injury occurred and what caused the injury. Blood samples would be analysed Detached components from rotating equipment can help to identify the sequence of events. The components would be identified with particular rotating equipment and evidence of damages or failure Broken glass or paint fragments can indicate a point of collision. Samples would be matched against vehicles or components Tyre marks on a road surface can indicate the direction, and possibly the speed, of a road vehicle. It would be important to demonstrate that the vehicle concerned made the marks
97
Briefing - Evidence Gathering (Cause and Effect)
Evidence at accident sites may be associated with the cause of the accident or the effect (or result) of the accident
Chicken or Egg?
98
Briefing - Evidence Gathering (Initiating and Managing Technical Investigations)
The necessity for technical investigations depends on the type of accident/incident, the evidence available, and relevance to the investigation process
On scene Mechanical Engineers Electrical Engineers Operations Managers Safety Managers Structural Engineers Fire Technologist Scientists/Technicians Off scene Metallurgists Quantified Risk Assessors Safety Case Managers Toxicologists
Careful management is necessary to ensure validity of results

99
100
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
101
102
Suggested solution Events and Causal Factors Chart

Supervision
Toxic Gas 350kg Bill Jones

TT 6 Mths Experience
Permit Weak Red Shift No Procedure Contractor Weekend Cleaning Maintenance No Detection Degassed Risk A Weak Blue Shift On Who? 12 Feed Unit 27 0815 Spades?
45 Mins Bleed Valve
T Thomas Blue Shift TT Reports Noise 0852 Road Block Emergency Response 0900 Line Isolation 0925
HSE RIDDOR Bill Jones Hospital
DBB Plant Isolation
Blue Shift Unit 300 Valve Open Spades?
TT/CS Handover 0700

Completed?
Leak
Spades Drain Open/Close ?
Permit Signature Spades?
103
104
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
105
106
Briefing - Evidence Gathering (Planning and Conducting an Interview)
Whether taking place at the scene or at the formal investigation stage, interviewing can be considered to consist of three stages
Preparation
Execution
Reporting
107
Briefing - Evidence Gathering (Interview Preparation)
Preparing for an interview can be further divided into five steps
Step 1: Defining Objectives

Preparation
Step 2: Selecting Interviewees Step 3: Designing the interview questions Step 4: Researching Information - and possibly going back to step 3 Step 5: Arranging the interviews
Careful preparation will result in less time being wasted asking unnecessary questions and focus the interviews on key information needs and gaps
108
Briefing - Evidence Gathering (Witnesses)
Witnesses who could be interviewed following an accident can be placed in four categories
Direct Witnesses Indirect Witnesses Circumstantial Witnesses Expert Witnesses Less directly involved in accident
Interviewed on-site (post accident) Likely timing of interview
Establishment of facts Likely purpose of interview
Interviewed at formal investigation stage
Obtaining an Opinion
Usually interviews at the scene are used to establish the facts. At the formal investigation stage, witnesses may be asked to build on the established facts and potentially give opinions
109
Briefing - Evidence Gathering (Attendance and Confidentiality)
The formal investigation team should understand whether a witness is obliged to attend and how confidential their evidence would be if they do attend
The Requirement to Attend Witnesses can refuse to co-operate, although the formal investigation team must reach conclusions in their absence Limitations to Confidentiality Relevant information arising from the formal investigation will be used in the Report Safety Regulators and/or Police can use information in the Report to direct their investigations
110
Briefing - Evidence Gathering (Interview Execution)
The execution of an interview can be further divided into introduction, dialogue and closing
Execution
Introduction Dialogue
setting the stage listening, questioning, summarising, clarifying, coping with questions summarising and taking leave
Closing
The choice, construction and delivery of questions is probably the most important part of interview execution
111
Briefing - Evidence Gathering (Questions)
It is likely during questioning that you will use a mix of open and closed and neutral and biased questions
OPEN NEUTRAL
CLOSED
Elicit information Elicit information
Probe/check
BIASED
Provoke
Test hypothesis
112
Open questions are used to introduce a new topic and are often used at the beginning of the interview For example
As a starter, can you briefly outline what the work at xxx is? In your own words can you tell me what happened on the day of the accident? For my information, and perhaps for everybodys here, could you tell me what your job is and what your responsibilities are? Please describe, to start off with, the job that you were doing when the accident occurred?
113
Closed questions are used to elicit very specific information, enabling the interviewee to offer a limited range of possible responses which can after be summarised in one word answers For example
Do you know any details of what the electrical equipment work involved? YES/NO When they went out to tender for the contract, did they include a pre-tender safety plan? YES/NO Would that review consider safety issues, such as the location of designated earthing points? YES/NO
114
Neutral questions are used most of the time, to establish facts, rather than for obtaining an opinion For example
How many people should it take to do this job? (Biased: Wouldnt you agree that this job needs twice the number of people now on it?) How did you feel about that? (Biased: And I expect you were not very happy about that?) Was there anyone on site who had the information to be able to call an ambulance quickly? (Biased: So there was nobody on site who had the information to be able to call an ambulance quickly?)
115
Biased questions are useful to test hypothesis or to challenge genuine responses, and when you want to overcome resistance or evasiveness For example
So as Project Manager you are not actually monitoring the safety checks on a weekly basis? (Neutral: So as Project Manager how often do you monitor the safety checks?) Is it now emerging that the part to which you fit a short earth was not installed two weeks previously when the design shows it should be? (Neutral: When did you realise the part to which you fit a short earth was not installed?, When does the design show it should have been installed?) Because the question that Ive got really is, didn't you have this particular method statement with you, even though you were the Supervisor originally? (Neutral: Did you have the method statement with you?)
116
Briefing - Evidence Gathering (Reporting)
Write up interviews while they are fresh in your mind. Generally, a good interview memo covers the background, your conclusions supporting evidence and next steps (if any)
Reporting
Background Interview: purpose, length, date and participants Interviewee: Name, job title, responsibility, history Conclusions and Evidence Provide conclusions (factual and emotional) Tie your conclusions back to the issues identified during preparation Support each conclusion Formulate opinions Next Steps Recommend next steps (if any) e.g. discuss issue with team member
117
Briefing Evidence Gathering
Exercise on managing difficult interview situations
Objective The purpose of this exercise is to identify and then manage different types of interview situations that could potentially occur while conducting an accident investigation Instructions Read the following scenarios and answer these questions for each:
What is happening? What would you do in this situation?
118
Scenario A
You are asked to interview Mr Baxter, who is a member of a shift team who recently had an accident where an operator (Joe Chaple) died. You start to question Mr Baxter about Mr Chaple, his fatally injured workmate. You ask In what state was Mr Chaple, this morning when he started work. Mr Baxter replies Joe Chaple, he was the best, um, safest worker around, you could always depend on Joe. You then ask So how was he this morning?. He replies Joe was fine, he was always fine, he was my best friend
119
Scenario B
A formal investigation is underway, and the Team has decided to interview Tim Berry, Millennium Maintenances Head of Operations. In an attempt to obtain information regarding the safety management system at Millennium Maintenance, you ask Tim Berry, How does Millennium Maintenance organise their Safety Management System?. Tim replies Well it is a lot better organised than your companys
120
Scenario C
During a formal investigation, a member of the investigation team who is from Millennium Maintenance has started to interview Mr Baxter (a Millennium Maintenance crew member). He starts his part of the interview with In your own words, describe what happened on the day of the accident. However, before Mr Baxter has a chance to answer, the Millennium Maintenance interviewer continues with Its probably best if you start by telling the Team how Mr Plumber (the Supervisor) had briefed you that morning about safety and informed you how the safe system of work would operate!
121
Scenario A
You are asked to interview Mr Baxter, who is a member of a shift team who recently had an accident where an operator (Joe Chaple) died. You start to question Mr Baxter about Mr Chaple, his fatally injured workmate. You ask In what state was Mr Chaple, this morning when he started work. Mr Baxter replies Joe Chaple, he was the best, um, safest worker around, you could always depend on Joe. You then ask So how was he this morning?. He replies Joe was fine, he was always fine, he was my best friend
Suggested Solution
The interviewee has become evasive The temptation here is to start asking closed questions, which could well make the situation worse. As yet you have not really established whether Mr Baxter is being evasive because Joe Chaple was his best friend or he wants to protect his job and Millennium Maintenance's contract. If it is the latter, it is unlikely you will be able to find out much more about the state of Joe Chaple and it is not worth during this interview further progressing this line of questioning (at the inquiry stage when the dust has settled, you can remind witnesses of their legal requirement to cooperate). However, at this stage it may be that Mr Baxter is being evasive because he feels a duty to Joe as his friend. Therefore, you could make the next question even more open e.g. What was the general state of the gang this morning? and then depending on the answer come back to questioning about Joe specifically. It is also not unreasonable to show some compassion at this stage and say something like Obviously, I did not know Joe, but from what you are saying he sounds like a great guy and then something like I think for Joes sake it is important we find out what really happened, How was he this morning?
122
Scenario B
A formal investigation is underway and the Team has decided to interview Tim Berry, Millennium Maintenances Head of Operations. In an attempt to obtain information regarding the safety management system at Millennium Maintenance, you ask Tim Berry, How does Millennium Maintenance organise their Safety Management System?. Tim replies Well it is a lot better organised than your companys
Suggested Solution
The interview has already started to focus on blame, rather than establishing the facts of the accident. The interviewee has also started to become hostile The interviewer must not get angry. You must also not take sides. Your questioning could therefore repeat the purpose of the investigation i.e. to identify the circumstances behind the accident with the object of ensuring effective management control and identifying immediate and root cause(s) as a means of preventing, or reducing the likelihood of, recurrence. The purpose of this inquiry is not to blame any particular person or company. We are really just trying to find out what kind of Safety Management System Millennium Maintenance has
123
Scenario C
During a formal investigation a member of the investigation team who is from Millennium Maintenance has started to interview Mr Baxter (A Millennium Maintenance crew member). He starts his part of the interview with In your own words, describe what happened on the day of the accident. However, before Mr Baxter has a chance to answer, the Millennium Maintenance interviewer continues with Its probably best if you start by telling the team how Mr Plumber (the Supervisor) had briefed you that morning about safety and informed you how the safe system of work would operate!
Suggested Solution
The Millennium Maintenance team member has asked a leading question, and therefore we are unlikely to find out what was in the safety briefing on the morning of the accident, or even if there was one It is the role of the Investigation Leader to control the proceedings of a Formal Investigation. He should therefore step in at this stage. However, if he does not, depending on how serious the leading questioning becomes, you should direct your concerns through the Investigation Leader, perhaps by suggesting a break and then discussing it with him and the other team members during the break, or write that you are concerned about the process and a break might be useful on a piece of paper and hand it to the Investigation Leader
124
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
125
126
Interview key Information that could be obtained
Interviewee was asked to be evasive Communication is not good between Trevor and his operators Thomas was not present at the handover and this was delegated to Bill Jones Briefing to operators of start up procedure was not good Double block and bleed not not explicitly shown on plan Contractor management experience/relations is not good Always previously worked alongside the contractor Not had any training in Isolation although responsible for the development of the procedure
127
Interview technique The following stages should have be undertaken
Introduction (both Interviewer and Interviewee) Questioning Open Closed Neutral Biased Was the interview structured and did the Interviewer concentrate on verifying the sequence of events and conditions Close Out Did the interviewer feedback what he had heard
128
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
129
130
Human factors are important to consider and understand when investigating incidents and accidents
Cross-industry evidence has found that human failure contributes to more than 75% of incidents The discovery of human failure is not sufficient we need to discover the causes of human failure so we can work towards prediction and prevention As a discipline, human factors provides a body of: Knowledge Tools Techniques to investigate the causes of human failure
131
Briefing - Introduction to Human Factors
The discipline of Human Factors takes a user centred approach to understanding systems where people interact with technology to perform a task
Example of a human/machine system Interpretation decision Operator (Man) Display instrument Perception Equipment Design Human Capabilities Human-Machine Interface Machine
Production Physical Work Environment
Handling of controls
Control instrument
Organisational Work Environment

132
Individuals bring a range of Personal Factors to work that can affect incidents and accidents
Individual/Personal Factors Physical fitness Psychological fitness Age and experience Competency
What an individual brings to work that affects their performance Ill health/incapacitation Influence of medication Personality traits/suitability State of mind Psychological conditions/illness Age/maturity Experience in current and previous roles Insufficient Knowledge/experience Skill
133
The causes of human failure need to look beyond the individual to consider the contribution of the task environment and wider organisational context
Personal/Individual Factors Characteristics that an individual brings to a work situation that affects the persons performance
Job/Situational Factors Factors associated with the task and the environment they are being performed in
Organisational and Management/System Factors Factors associated with complex organisational and social systems
134
Briefing - Introduction to Human Factors (HSE 48 model)
Human Factors in accident investigation is concerned with the aspects of a system which make it vulnerable to human failure
Personal/Individual Factors Low skill and competence levels Tired staff Bored or disheartened staff Individual medical problems
Job/Situational Factors Illogical design of equipment and instructions Constant disturbances and interruptions Missing or unclear instructions Poorly maintained equipment High workload Noisy and unpleasant working conditions
Organisation and Management/System Factors Poor work planning,leading to high work pressure Lack of safety systems and barriers Inadequate responses to previous accidents Management based on one-way communication Deficient co-ordination and responsibilities Poor management of health and safety Poor health and safety culture
Human factors refer to environmental, organisational and job factors, and human characteristics which influence human behaviour at work in a way which can affect health and safety (HSE Definition)
135
Human failure can be divided into unintended actions and intentional behaviour
Skill - based Slip Attention failure Recognition failure Un-intentional Actions Intentional Actions Violation Lapse Memory failure Rule based Knowledge based Routine Situational Exceptional Personally optimising Sabotage
Human Failure
Mistake
Human failure is often cited as a causal factor in accidents. It is therefore important to understand how it can be understood as part of the investigation process
136
The key to preventing workplace violations is understanding the unwritten rules that are driving them Introducing more discipline or enforcement may not always be the answer
The workers would not follow The workers would not follow the rules... the rules... so management introduced so management introduced more discipline... more discipline... but the workers still didnt but the workers still didnt follow the rules. follow the rules.
Why not? Because often violations are reasoned responses given the prevailing circumstances, not just wilful disobedience
137
Motivators are the reasons why people decide to break the rules. There are five main types of motivators to consider
MOTIVATORS
Routine
Rule considered unnecessary/violation has become normal working practice
Situational
Rules are difficult/impossible to follow in the work situation
Exceptional
Rule breaking due to unusual circumstances (e.g. emergency) often with unknown outcomes
Personally optimising
Violation to benefit personally e.g. financial gain, making life easier
Sabotage
Due to conflict, intending damage or harm
138
Modifiers are the conditions which make violating more or less likely. There are eight common types of modifier
MODIFIERS 1. 2. 3. 4. 5. 6. 7. 8. Poor perception of risk Low chance of detection Ineffective disciplinary procedures Lack of reward for safe practice Poor accountability Poor supervisory style Complacency caused by accident-free environment Inadequate management attitude
139
Once motivators and modifiers have been identified, the causes of violations will be much clearer, and possible solutions can be established
Motivators Modifiers Poor perception of risk Low chance of detection
example
Routine (driver has at some point decided the rule is unnecessary) Cars are safer Belief in own ability to drive at speed higher than limit
Driving over the speed limit on a highway
Likely Areas for Action Awareness campaigns Increased monitoring/detection More effective disciplinary procedures
140
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
141
142
Briefing Corporate Safety Culture
The Corporate Safety Culture is also an additional factor to consider and understand when investigating incidents and accidents
Good corporate safety culture starts with: Visible commitment and demonstration from the senior management and active implementation of safety policies by all employees Development of the belief that all accidents are preventable though implementation of suitable procedures and encouragement of suitable safety behaviour
143
Briefing - Corporate Safety Culture
A good corporate safety culture will be supported by systems, processes and visible commitment. Best Practice guidelines include:
Drafting a clear HSE policy that is communicated and discussed with all staff before being made final Informing the staff of the need to be open and transparent with a commitment from management that no punishment will be attached to any incident reported a no blame culture Consulting employees and involving them in the setting up of the HSE reporting system, other HSE systems and issues Implementation of systems for proactive monitoring and related reporting of HSE matters e.g. audits, inspections, surveillance, sampling, etc. Implementation of proper systems in place for reactive and reporting measures following incidents Devising straightforward and easily followed reporting systems with a minimum of paper work
144
Briefing - Corporate Safety Culture
A good corporate safety culture will be supported by systems, processes and visible commitment. Best Practice guidelines include: (continued)
Conducting training to clarify the requirements and to ensure proper understanding and adherence to the system Conducting awareness campaigns and training sessions to all staff to emphasise the importance of reporting all HSE incidents and near misses Visible commitment from senior management providing the good example for staff regarding the adherence to safety rules and the demonstration of commitment Given high priority to HSE matters and their resolution once identified Financial and career incentives to reward good safety performance
145
146
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
147
148
Briefing - Interface Management (Stakeholders in the Accident)
As soon as the accident takes place, there may be other interested parties who may help and or restrict the investigation process
Emergency Services Loss Adjusters
Other Companies
Police Relatives of victims
Accident
Government
Media Safety Regulator
Municipality
149
Briefing - Interface Management (Stakeholder Expectations)
What are the expectations/needs of these stakeholders?
Stakeholder Emergency Services Other Companies Police Government Safety Regulator Municipality Media Relatives of Victims Loss Adjusters
Expectations/Needs of Stakeholder
How will these expectations impact on the formal investigation?

150
Briefing - Interface Management (Stakeholder Expectations)
What are the medias needs?
To be the first with the news and meet deadlines To publish details of casualties To give human interest stories To present the facts including statistics To bring stories to life with interviews and quotes To show dramatic pictures To describe events as they develop To establish the cause To find new angles different from other coverage
151
Briefing - Interface Management (Incident Management)
Three levels of incident management are typically set-up
OPERATIONAL
Incident scene
TACTICAL
Refinery
STRATEGIC
Headquarters
152
Briefing - Interface Management (Accident Management)
There are a range of related activities, depending on the accident consequences

Operational Tactical Fire fighting Fire fighting First Aid First Aid Damage Control Damage Control Repair Repair
Incident Control Incident Control
Emergency Emergency Response Response
Operational Tactical
Co-ordination of operational support Co-ordination of operational support Liaison with Emergency Services Liaison with Emergency Services
Tactical Emergency Emergency Management Management Strategic
Overall management of the emergency Overall management of the emergency Co-ordination of broader support Co-ordination of broader support Liaison with customers, government etc. Liaison with customers, government etc. Media & relatives Media & relatives Manages impacts on businesss image, Manages impacts on businesss image, operations and liabilities operations and liabilities Manages impacts on corporate image, Manages impacts on corporate image, operations and liabilities operations and liabilities Handling of Government, media, Handling of Government, media, partners, shareholders, etc. partners, shareholders, etc.
Strategic Crisis Management Crisis Management Elements of Tactical
153
Briefing - Interface Management (Blame Processes)
The formal investigation is aimed at prevention/mitigation. However, information produced has historically been used to attribute blame
Contractual Disagreements Insurance Claims Formal Investigation Information Allocation of lost revenue Criminal Charges - Individual/Corporate
Prevention/Mitigation Process
Blame Processes
154
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
155
156
Some information on a crushed finger incident
Whilst engaged in soil boring operations for the preparation of a storage tank base at an onshore petrochemical plant and during routine change-out of a worn bit, the sub contract drill operator sustained a crushed finger This injury occurred whilst unscrewing the drill string, when the drill string separated from the connecting collar and dropped trapping the operators finger against the ground The drill operator was not wearing gloves at the time of the incident The drill mast is capable of being laid in the horizontal position and it was customary to turn the mast to the 45o position from the vertical, but it was vertical when the incident happened There was no procedure requiring the mast to be laid horizontal for bit changes, the practice for bit changes is passed from operator to operator during the training period
157
Some information on a crushed finger incident (continued)
The bedrock at this location is particularly hard and has Sub-surface cracks and fissures, which cause loss of airlift to the cuttings The hard bedrock increases the frequency of bit changes, which also increases the frustration level of the operator The work-pack for this work did not identify that the bedrock was unusually hard and required special hardened bits The contract did not specify the requirements to provide procedures for the specified activities
158
As a team complete a Summary Analysis for the incident report provided
Identify the following:

Consequences/event Controls Immediate Causes - Unsafe Acts and Unsafe Conditions Preconditions - Personal, Job and Management Factors Underlying (Root) Causes - Systems Failures Areas where information was insufficient or incomplete Areas requiring additional investigation?
159
160
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
161
162
Emergency Management Planning
This section builds on the Emergency Management Planning section of the HSE Management Systems Course, looking in more detail at Emergency Planning and Emergency Response Management
Management and Authorisation for operation of Hazardous Installations Emergency Planning General Principles Offsite Emergency preparedness programmes Onsite Emergency Planning Training, Drills and Exercises Emergency Response Management Potential Company Reputation Damage Emergency Response Plan Personnel Response Team
163
Briefing Management and Authorisation for operation of Hazardous Installations
The Public Authority should have established a clear and coherent control framework for the management and authorisation of hazardous installations
1. Definition and establishment of requirements for different types of installation 6. Requirement for cooperation and coordination between onsite and offsite emergency response teams 2. Establish procedures and criteria for the planning, siting, licensing and permission to operate within defined operating criteria
Control framework content

5. Development, implementation and testing of onsite and offsite emergency plans 3. Arrangements for monitoring of the safety performance of the installation
4. Criteria for enforcement action in case of noncompliance
164
Briefing Emergency Planning Guiding Principles
Emergency planning development is a critical part of any hazardous installations risk management program
The principle objective of an emergency response plan is is to localise any accidents that may occur and, if possible, contain them and minimise any harmful effects of the accident on health, environment and property Emergency planning should include both onsite and offsite emergency planning:
Onsite accidents Offsite storage areas Pipeline accidents
Road transport accidents
Ship bulk transportation
165
Briefing Emergency Planning Guiding Principles
Emergency planning should be undertaken by both the Public Authority and the hazardous installation in parallel
Onsite and offsite integration There should be close cooperation and coordination between those responsible for onsite and offsite emergency planning The onsite and offsite emergency plans should be consistent and integrated and should be based upon both generic and specific hazards and potential accident scenarios including low probability, high consequence incidents Complicating factors The emergency planning process should consider complicating factors, e.g.:
Loss of power and utilities Difficult weather conditions
Onsite maintenance
Day/night and weekend incidents
166
Briefing Emergency Planning Onsite and Offsite Emergency Planning
The emergency planning process should also include an evaluation of potential hazardous scenarios, existing infrastructure and what improvements are required
During the emergency planning process there should be a realistic evaluation of competencies and resources The emergency planning should consider any requirements for backup systems Succession training Alternative communication channels Second accident command centre Site evaluation planning Mutual assistance between sites within an industrial complex Necessary financial support should be provided to ensure all emergency response equipment is maintained, available and the emergency response teams are trained in their use
167
Briefing Emergency Planning Onsite and Offsite Emergency Planning
Onsite and offsite emergency plans should include the following

Onsite emergency plan
Full scale plan of the installation List of identified generic and specific hazardous situations List of all hazardous substances handled identifying location on site, process conditions and basic safety information Information on the emergency shutdown and isolation philosophy Location and description of emergency response equipment Roles and responsibilities for personnel Description of evacuation procedures and personnel refuge locations Procedure for notification of accidents to local/national public authorities
The onsite plan should be completed by a team of professions including engineering, operations, HSE department and emergency response.
Offsite emergency plan

Full scale map of the installation and surrounding area List of identified generic and specific hazardous situations List of all hazardous substances handled and process conditions Roles and responsibilities Location and contact details for public authority communication/command centres Contact numbers of national experts on emergency response, and international response teams Media communications spokesperson
The offsite plan should be completed by a team of professions from the hazardous installation, public authority and public emergency services
168
Briefing Emergency Planning Training, Drills and Exercises
Rapid and effective implementation of the emergency response plan requires the primary response teams to be familiar with the site, equipment and emergency plan requirements
All emergency response teams (onsite, mutual assistance teams, offsite emergency response) should be familiar with: The site layout Location of key installations (emergency gates, water and foam supply points, refuge locations etc) The potential hazardous materials handled Emergency plans and personnel The emergency plans and training should provide guidance and principles and not be too prescriptive to allow for a flexible response to the accident
169
Briefing Emergency Planning Training, Drills and Exercises
Rapid and effective implementation of the emergency response plan requires the primary response teams to be familiar with the site, equipment and emergency plan requirements (continued)
Regular exercises of both onsite and offsite should be undertaken, and include where appropriate mutual assistance and offsite emergency response teams: The exercises should be observed and assessed by independent personnel as a means for identifying areas for improvement The exercises should be programmed to test different aspects of the emergency plans and include both desk top and onsite exercises The exercises should also be undertaken in adverse conditions e.g. night shifts Feedback from the exercises should be provided to the senior management, incident commanders/ coordinators and emergency response team. This should be used as a basis for Identification of insufficient resources Training and development Correct action of third party Evaluation of the emergency plans
170
Briefing Emergency Response Management Potential Reputation Damage
Effective Emergency Response Management is critical to ensure that an emergency doesnt escalate into major crisis/disaster
Poor incident management can result in a public perception that the company is incompetent and unprepared for such situations resulting in an immediate significant loss in the companys asset valuation and reputation Damage to a companys reputation can have significant impact on an companys operations: Loss of investor confidence Poor employee morale Delayed regulatory investment planning approvals Increased insurance premiums etc. The effective management of an incident requires a suitable organisational structure in many cases different to that required for normal day-to-day operations, requiring different specialist functions, teams, procedures, reporting structures and communication channels to be mobilised
171
Briefing Emergency Response Management Potential Reputation Damage
How a company manages a local emergency can have worldwide implications on the companys operations given the speed of the media
Lord Cullen noted in the Piper Alpha disaster report that: I am not satisfied that the system as operated on Pipe Alpha can close to achieving the necessary understanding on the part of all personnel as to how to act in the case of an emergency. He added that management failed to ensure that emergency training was being provided as they intended. The platform personnel and management were not prepared for a major emergency as they should have been. The safety policies and procedures were in place: the practice was deficient The perception that a company has reacted badly to an emergency, right or wrong, tends to reinforce the view that that it must have been incompetent in allowing the incident to occur in the first place
172
Briefing Emergency Response Management Emergency Response Plan
Many companies develop a separate Emergency Response Plan to ensure effective incident management
The Emergency Response Plan focuses on the systems and facilities required for the wider management of the incident: Minimising casualties and providing the necessary infrastructure for evacuation Treating and identifying the injured (on and off-site) Systems for ensuring that all personnel are accounted for as rapidly as possible and relatives informed to minimise worry Meeting survivors and making provision for their immediate welfare and immediate relatives Providing the necessary long term personnel and back-up equipment/supplies Communication of information between the site, central headquarters and other sites Informing employees of what has happened and what action should be taken Limiting the impact on the companys reputation and market value
173
Briefing Emergency Response Management Emergency Response Plan
Many companies develop a separate Emergency Response Plan to ensure effective incident management (continued)
The development of the Emergency Response Plan will typically depend upon a two important factors: the site and geography, and the size and culture of the company The Emergency Response Plan should typically include consideration of the following: Defining the extent of the emergency and necessary immediate action Organisational structures and accommodation Manpower management and movements Access and transport to site for mobilisation of response teams Management of survivors and their relatives Team support functions External communications and communication equipment Documented action and communication records Financial management Legal support
174
Briefing Emergency Response Management Personnel Response Team
The Personnel response team is a function in a major disaster managing the communication between the company and relatives
The personnel team has a responsibility to remove pressure from the onsite emergency response and operational teams, alleviating the worry felt by relatives and limiting the damage to the companys reputation The largest single problem that needs to be considered during the development of the Emergency response plan is the rapid and accurate location of personnel at the time of an emergency Telephone operators: Should be trained appropriately Should document the caller identity, condition, date and time of call in a log sheet
175
Briefing Emergency Response Management Personnel Response Team
The Personnel response team is a function in a major disaster managing the communication between the company and relatives (continued)
To ensure that the organisation has the necessary company policies in place and systems for collation of information in the event of an emergency The following are typical questions asked by relatives in the event of a major accident:
Was he working at the site at the time of the emergency? What is his condition now and what are you doing to help him?
Is he alive?
Where is she now and can I see her?
How do I get to.?
Will you organise my travel, and when can I leave?
Will he be able to work again?
176
Briefing Emergency Response Management Interfacing with the Media
The company should have the necessary systems and organisation in place to ensure effective media communications is established and maintained
It is not advisable to prevent access to the media as it can result in the development of rumours and speculation about the incident, which are not based on facts A lack of accurate and prompt information provides an overall perception of lack of planning, ineffective incident management with the potential for rapid reputation damage A constructive relationship should be established with the media to ensure that the company is: Established as competent and responsible Controlling the incident and doing all that can be done to minimise the impact of the accident Able to manage its image and reputation Able to communicate to local residents directly and efficiently
177
Effective media communications are critical to minimise the potential for local impact on company operations
To ensure that these objectives are met the media communications team should: Control the flow of information about the incident Act as a single authoritative source of information Ensure that the information is standardised and consistent Use the media to obtain information (e.g. public feeling, external perceptions) Maintain the medias interest to minimise the potential local impact on operations Emergency response activities Overload of company telephone network Uncontrolled interviews and personnel opinion Company subsidiary operations
178
The company media response team should have the necessary systems and organisation in place to access and collate information requirements
To ensure that the organisation has the necessary systems for collation of the information, the following are typical questions asked by the media in the event of a major accident:
What is the emergency telephone number that relatives should call?
What has happened and where? What is the senior managements reaction to the accident?
How many people were on the site at the time of the accident?
When will normality be restored?
What is your safety record?
Have there been any injuries or fatalities?
179
Company fact files containing general company information can be prepared and used immediately in the event of a major accident
In addition to the accident response information, many companies develop company and facility fact files that contain general background information which can be provided along with the holding statement to the media These fact files are not incident or accident specific but contain information such as: Background on the company including International and National activities Map of location Picture of the facility General information of production activities and number of employees Facilities in the vicinity of the plant Company and site specific safety performance statistics Glossary of technical terms It is important to ensure that all press statements issued are consistent to what has been issued before, and do not try to hide changes in information or situation
180
Briefing Emergency Management Planning Assessment
During the accident investigation it is important to concentrate on identifying the immediate and underlying causes. However it is also important to analyse the effectiveness of the Emergency Response
Incident Detection Incident Detection How was the incident detected?Did any systems fail? How was the incident detected?Did any systems fail? How long did it take for the incident to be detected? How long did it take for the incident to be detected? Was the incident independently confirmed? Was the incident independently confirmed? Were the correct notification procedures followed? Were the correct notification procedures followed? Were the correct personnel notified and contact details correct? Were the correct personnel notified and contact details correct? How was the alarm raised? How was the alarm raised? Any problems with the first line response -- equipment, containment? Any problems with the first line response equipment, containment? Any problems with site communication channels or responsibilities? Any problems with site communication channels or responsibilities? How effective was the site first aid and medial services? How effective was the site first aid and medial services? Any communication problems with 3rd parties and response time? Any communication problems with 3rd parties and response time? Were the 3rd party response teams prepared, site access, site knowledge? Were the 3rd party response teams prepared, site access, site knowledge? How well did the 3rd party teams integrate with site response teams? How well did the 3rd party teams integrate with site response teams? Any problems in mobilising and coordinating emergency response plan? Any problems in mobilising and coordinating emergency response plan? How effective was the communication with adjacent hazardous facilities? How effective was the communication with adjacent hazardous facilities? How effective was the communication with regulators, municipality etc? How effective was the communication with regulators, municipality etc? How did the personnel and media communication teams perform? How did the personnel and media communication teams perform? How effective was mobilisation of expert emergency response teams? How effective was mobilisation of expert emergency response teams? How effective was the long term support and damage control actions? How effective was the long term support and damage control actions?
Incident Incident Notification Notification
Incident Control Incident Control
Emergency Emergency Response Response Emergency Emergency Management Management
Crisis Management Crisis Management
181
182
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
183
184
185
186
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
187
188
Briefing - Write-up and Presentation
The overall goal of an accident report is to document the investigation findings, conclusions and recommendations clearly and accurately
In this section we will consider the: Format of the investigation report General principles in report writing Discussion Conclusions Plain English Recommendations
189
Briefing - Write-up and Presentation (Format of the Report)
Good practice in structuring formal investigation reports
Part A - Title, reference number, date Part B - The following statement: "The investigation has been conducted with the objective of determining the facts of the accident/incident, the immediate and underlying causes, and of making recommendations to prevent, or reduce the risk of recurrence. The report is for the use of persons with a direct responsibility for improving, or maintaining, process industry safety. The objectives of this inquiry/investigation were not the allocation of blame and liability and thus the information contained should not be construed as creating any presumption of these. Part C - A copy of the Terms of Reference Part D - Details of the accident/incident Part E - A brief description of the sequence of events Part F - A summary of the evidence considered relevant Part G - Discussion Part H - The conclusion(s), including the immediate and underlying causes Part I - The names, and signatures, of investigation team members Part J - Recommendation(s) Appendices - Other information relevant to the understanding of the report
190
Briefing - Write-up and Presentation (Investigation report structure)
The Report structure described is designed to improve the traceability of evidence through to recommendations
Sequence of Events
E
Summary of Evidence
Discussion
Conclusions
Recommendations
191
Briefing - Write-up and Presentation (Investigation Report Structure)
Good practice in accident investigation report writing
Be accurate and indicate where the team have taken decisions based on conflicting evidence Avoid the use of staff names this helps to stay away from blame allocation Get all the investigation team to sign the report do not allow minority reports Address all aspects of the Terms of Reference
192
Briefing - Write-up and Presentation (General Principles in Report Writing)
The following principles provide useful pointers when writing the report Do not overstate the facts State the facts as you have discovered them but avoid overly broad conclusions from facts
example
Do not say . . . The maintenance contractor has not carried out any safety training in the last 5 years
If you mean . . . None of the maintenance contractors in the team have had safety training in the last 5 years
193
The following principles provide useful pointers when writing the report (continued) Distinguish between performance and documentation Some regulatory requirements specify that a particular activity or programme be conducted, but do not specify that the completion of the activity be documented
example
Do not say . . . Weekly inspections of the site are not conducted
If you mean . . . Weekly inspections of the site are not documented
194
The following principles provide useful pointers when writing the report (continued) Avoid generalities Generalities and vague reporting will confuse and mislead the reader. The specific problem should be succinctly communicated
example
Vague The contractors method statement was incomplete
More helpful The contractors method statement did not: a) Identify the hazards that would be encountered when completing the work b) Indicate the control measures that would be implemented
195
The following principles provide useful pointers when writing the report (continued) Communicate the magnitude of the problem Although the wording of the description of the accident may be correct, it may not contain enough information to fully communicate the nature and extent of the problem
example
Poor Members of the team were untrained
Improved Three out of the ten team members involved in the job had not received any formal safety training
196
The following principles provide useful pointers when writing the report (continued) Avoid extreme language Refrain from using such deprecating words as careless, terrible, dangerous, intentional, severe, reckless, incompetent
example
Poor The maintenance team were incompetent in the way that the equipment had been isolated prior to the accident
Improved A specific work procedure for the maintenance of the system had not been prepared, and the team had not followed general refinery practices to isolate the system using double block and bleed isolation and positive isolation of the control system
197
The following principles provide useful pointers when writing the report (continued) Use familiar technology Not all recipients of the report will be involved in safety activities on a daily basis or know the technical terms used in specific petrochemical disciplines. They therefore may not be familiar with certain safety acronyms and jargon
example
Poor The LEL HL alarm did not trip the BL ESV
Improved The lower explosivity limit high level alarm did not trip the Battery Limit Emergency Shut Off Valve
198
The following principles provide useful pointers when writing the report (continued) Avoid contradictory messages Activities presented in a positive light, when the ultimate message will involve pointing out deficiencies, may confuse the reader and obscure the real message
example
Poor Although the Acid Plant has a process operator induction course, it lacks an overall assessment of competence
Improved The Acid Plant process operator induction course lacks an overall assessment of competence
199
Briefing - Write-up and Presentation (Discussion)
The development of the Discussion section can be made easier by having on-going feedback with the team, summarising evidence in a specific accident area
On-going feedback with team
Summarise evidence in a specific area
Develop the Discussion section with the rest of the team The Discussion section should specifically cover all aspects of the Terms of Reference
200
Briefing - Write-up and Presentation (Discussion)
In addition to checking with the Terms of Reference a quick check can be made on the factors to be considered using a simple activity/organisation level grid
Measuring Performance Review/ Audit
Policy Industry Company Department Level Supervision/Safety of Workgroup Workgroup Level Individual Level
Control
Co-operation
Comms
Competence
Planning
Implementation
2 1
For example 1) The fact that the weather was cold could have been considered to be a significant factor during implementation at the workgroup level 2) The fact the Supervisor was not qualified would be a competence issue at the Supervision/Safety of work group level
201
Briefing - Write-up and Presentation (Conclusions)
The conclusion should have at least two sections
The Immediate Cause(s): The immediate cause(s) is an unsafe act or unsafe condition which causes an accident or incident
The Underlying Cause(s): Underlying cause(s) are any factors which led to the immediate causes of accidents or incidents, or resulted in such causes not being identified and mitigated
It may also be appropriate to include in the conclusion any issues that have important safety implications but did not have any bearing on the accident
202
Briefing - Write-up and Presentation
Writing reports is a key skill for Investigation Leaders
The main deliverable from an accident investigation is a report and within the report some recommendations The quality of accident investigations is usually judged by the quality of the report The writing of the report is the responsibility of the formal investigation leader
Everything we write has an impact and creates an impression

203
Briefing - Write-up and Presentation (Clarity?)
Consider the following, taken from the Resolutions put to an Annual General Meeting of a Life Insurance company: (2) If, according to the terms of the policy or in consequence of assignation or other transference of any kind, the assignee has acquired or shall acquire the absolute right to such policy such assignee may, subject to paragraph (3) of this regulation, become a member in place of the person already a member of the Company in respect of that assurance if agreed between himself and the directors, provided that he complies with such requirements as may from time to time be prescribed by the directors, and on such person becoming a member of the Company, the former member of the Company shall cease to be a member in respect of that assurance
Is this plain English? No!
204
Briefing - Write-up and Presentation (The Perfect Recommendation)
It is not possible to define a perfect recommendation but there are some good and poor practices
Recommendations are not a science, and it is not possible to define a perfect recommendation Many individuals and organisations can tell you rules for writing recommendations, but these are still in part subjective We can often recognise poor recommendations - by avoiding poor recommendations we are using good practice!
205
Briefing - Write-up and Presentation (Good Recommendation)
A good recommendation should:

Define what is to be achieved (but not how) Be directly related to the accident Be targeted against a single company for action Identify the intention of the recommendation by adding a sentence Prevent recurrence of the accident (or one of the causes) Reduce the likelihood of recurrence Reduce the consequences of such recurrence Be referenced to the conclusions
Other good practices

Group recommendations under a heading Do not omit recommendations on cost grounds alone
206
Briefing - Write-up and Presentation (Recommendations)
A considerable amount of resource is required to implement and track recommendations. It is therefore important that:
Recommendations address issues of a system nature rather than corrective actions (e.g. requiring compliance with an existing standard is a corrective action) Recommendations from previous investigations are considered (in which case reference to the appropriate recommendation should be sufficient) Recommendations made are really necessary
207
Briefing - Write-up and Presentation: Exercises
How can the following conclusions and recommendations be improved?
Conclusion - Communication between Control Room staff and operators leading up to the accident was not of the standard required for safety related issues. In particular, insufficient effort to identify the persons involved in each conversation, and their location, was apparent Recommendation Company X should introduce measures to remind all front line staff of the required standards for safety related communication
208
Conclusion - The requirement to maximise crude throughput caused Controller X to authorise the start-up of the Vacuum Distillation Unit before all the required safety procedures had been carried out Recommendation All oil companies should ensure that all staff involved in operations are re-briefed that whilst maximising crude throughput is important, the first concern of everyone must be safety, regardless of the impact on production
209
Conclusion Company Bs priorities for worksite visits and audits did not identify this type of activity as a priority for management action Recommendation Company B should carry out an audit of contractors management and supervision of sub-contractors when used for pipeline painting work
210
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
211
212
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area Introduction:
An incident occurred when the pump station sump pit overflowed into the surrounding area creating a significant pool of crude oil The spill of product was due to a 1-inch drain line being left in the open position following the re-commissioning of the electrical driven Main Product Pump The open valve is located on the pump suction
213
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued) Sequence of Events:
The electrical driven Main Product Pump was taken out of service at 0805 in order to clean the in-line pump suction strainer Due to the large volumes of product that is required to be drained down to the pump station sump tank from the system, it was necessary to open several drain points in the pump suction and discharge piping and pump casing. The product is returned to the MOL suction line via the sump pump under level control Following the re-installation of the pump suction strainer, the electric driven Main Product Pump was recommissioned at 1600. The gas turbine driven pump was shutdown at 1616 The shift on duty that afternoon consisted of: Senior Operator Field Operators x2 General Operator
214
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued) Sequence of Events (continued):
While checking the pump station at 1730, the operator found product overflowing from the pump station pit. Product was flowing over the surrounding area The operator found a drain valve had been left open on the pump piping, which he closed The senior operator telephoned the Production Supervisor to report that a spill had occurred when pump sump pit overflowed as a result of leaving a drain valve open when the electric driven Main Oil Pump was re-commissioned The Production Supervisor was not on duty or available at the time At 1815 the Production Supervisor, based on the information given by the Senior Operator, advised that action would be taken to clean up the product spill the following day
215
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued) Sequence of Events (continued):
Neither the Senior Operator nor the Production Supervisor called the Standby Production Supervisor or the Standby Safety Officer The correct action in this situation would have been to inform the following: The Duty Production Supervisor The Standby Safety Officer The Production Senior Duty Officer At approximately 0200, the Security Officer who was patrolling the area noticed the product spill from the adjacent road and called the Standby Safety Officer The Standby Safety Officer advised the Standby Production Supervisor
216
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued) Conclusions:
The Operators who re-commissioned the pump failed to ensure that the pump and ancillary equipment was lined up correctly Although the Senior Operator called the Production Supervisor, he did not take the correct actions as previously indicated Although not on duty, the Production Supervisor demonstrated poor judgement, as well as failing to inform the Duty Production Supervisor. He did not appreciate the seriousness of the situation Night Shift operators did not advise anybody, indicating that the pump station had not been visited
217
The following is an initial report on an incident involving the spillage of large quantities of product in an operating plant area (continued) Recommended Corrective Actions:
1. Severe disciplinary action should be taken against the operators involved with the commissioning of the pump and for mal-operation of the process facilities and failing to follow procedures 2. A warning letter to be issued to the Production Supervisor for poor judgement and for failing to follow procedures 3. All incidents however minor in nature must be reported immediately and procedures strictly followed 4. All personnel must familiarise themselves completely with the emergency procedures 5. Incidents of this nature clearly demonstrate the requirement for Shift Production Supervisors at these types of facility
218
As a group discuss the Recommended Corrections Actions provided in the Case Study and complete the following activities utilising the Recommended Corrective Action Checklist
Were the Corrective Actions provided in the case study suitable? Which ones do you consider unsuitable and why? Propose Corrective Actions that are more suitable Justify their suitability by utilising the Recommended Corrective Checklist What areas in relation to the case study in your opinion need additional information and/or investigation?
219
220
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
221
222
223
224
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
225
226
227
228
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
229
230
We suggest the following Conclusions
Immediate Cause During the removal of isolations of Unit 300 a process operator did not shut the drain valve in the feed line from Unit 27, which led to a release of 350kg of toxic process material and injury to another process operator during the re-commissioning of Unit 300 Underlying Causes The Permit to Work did not identify the detail of the work to be carried out, had conflicting dates and had not been signed-on for the day of the accident The handover between process shift teams did not accurately identify the status of Unit 300 and its isolations The isolation valves for Unit 300 where not labelled There was no risk assessment of the procedures for an isolation involving toxic process material There was a lack of communication within Ruhta Chemicals on when documented procedures are required The responsibility for the approving procedures within Ruhta Chemicals is not defined Ruhtra Chemcials did not manage the involvement of contractors (including no adequate process and no defined responsibilities) in the chemical clean of Unit 300
231
232
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
233
234
Review of NPC Accident Investigation Report Tondguyan Accident
Using your own knowledge and experience review the Tondguyan petrochemical incident report that resulted in death and injury to operators during the start up of D1404 tankage following maintenance
Comment on the linkage between the accident description, findings and observations, cause of Accident and conclusions Confirm whether it is possible to identify the events, conditions, casual factors and root causes of the accident using only the information provided in the report Confirm whether it is possible to state the lessons learnt and what steps should be taken to ensure the same thing does not happen again based upon the information provided in the report Comment on the suitability of the report and suggest any recommendations for improvement
235
236
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
237
238
Review of NPC Emergency Response Manual Emergency Planning
Using your own knowledge and experience, work in groups to review the NPC Emergency Response Planning requirements (Sections 1-9)
Comment on any identified strengths and weaknesses. Please support any comments with evidence/reference to the documentation provided Consider how each of your respective complexes have addressed and implemented any requirements of this documentation
239
Review of NPC Emergency Response Manual Emergency Simulations
Using your own knowledge and experience, work in groups to review the various emergency simulation assessment reports provided
Comment on any common identified strengths and weaknesses across all of the reports provided (Planning of the exercise, execution, assessment and reporting) Consider the content and structure of the emergency simulation assessment reports Are there clear linkages between the objectives set, assessment undertaken and suggestions/recommendations made in the report. Develop alternative observations, suggestions and recommendations based upon the results of your assessment Please support any comments with evidence/reference to the documentation provided Consider whether each of your respective complexes have developed emergency response procedures/plans (of the type described) for each of the major identified hazards onsite Consider the strengths and weaknesses of developing detailed response procedures/plans for each potential incident vs more generalised emergency response procedures
240
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
241
242
To summarise, the Accident Investigation Course has been structured in 6 sections covering each of the major phases of an investigation
The accident investigation process Introduction to accident investigation and why effective accident investigation is so important Accident investigation tools and techniques Introduction to various tools & techniques to support effective accident investigation and identification of immediate and underlying causes The process of evidence gathering Description of the various types of evidence and consideration of which order they should be collected The contribution of human factors and safety culture An introduction to human factors and safety culture and there importance in accident investigation and development of effective recommendations
243
To summarise, the Accident Investigation Course has been structured in 6 sections covering each of the major phases of an investigation (continued)
The process of emergency management planning An introduction into effective emergency response planning and crisis management Examples of how to assess the effectiveness of the emergency response during the accident investigation process The effective reporting of the accident investigation process An introduction to a number of best practices that have been adopted in the industry for the structuring of Accident Investigation Reports Guidance on the presentation and language that should be used in the writing of the reports
244
During this course we have also tried to recreate some of the stages of accident investigation and demonstrate good and bad accident investigation assessment through the various Case Study exercises
The BBC Piper Alpha video provides a very good introduction into how accidents develop and the fact that many accidents occur due to the failure of a numerous barriers The ADL Case Study Provides the opportunity for developing an accident investigation file, evidence assessment, interpretation and conflict resolution Interviewing exercise provides an opportunity for improving interviewing skills such as questioning, listening, documenting and time management Assessment of emergency response plans demonstrates the key linkages with other site activities such as project planning, risk assessment and communication Provides an opportunity for delegates to bring together all the evidence gathered and develop reasoned arguments and well structured statements for the key sections of the accident investigation report Individual case study exercises demonstrate the results of insufficient and/or poor accident investigation reports, both in terms of identification of root causes and inappropriate recommendations
245
246
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
247
248
Revision of Past Major Accidents - Seveso
A dense vapour cloud containing tetrachlorodibenzoparadioxin (TCDD) was released from the reactor of a chemical plant manufacturing pesticides and herbicides in 1976. The poisonous vapour contaminated some ten square miles of land and vegetation. More than 600 people had to be evacuated and 2,000 were treated for dioxin poisoning
Key lessons learnt from Seveso Public control of major hazard installations Siting of major hazard installations Acquisition of companies operating hazardous processes Hazard of ultratoxic substances Hazard of undetected exotherms Hazard of prolonged holding of reaction mass Inherently safer design of chemical processes Control and protection of chemical reactors Adherence to operating procedures Planning for emergencies Difficulties of decontamination
249
Key Lessons Learnt From Major Accidents - Piper Alpha
In July 1988, an explosion on the Piper Alpha oil rig in the North Sea resulted in a fire that completely destroyed the platform, and cost 167 lives and millions of dollars a day in lost revenue
Key lessons learnt from Piper Alpha Regulatory control of offshore installations Quality of safety management Safety management system Documentation of plant Fallback states in plant operations Permit-to-work systems Isolation of plant for maintenance Training of contractors personnel Disabling of protective equipment by explosion itself Onshore installations; control of pressure systems for hydrocarbons at high pressure Offshore installations; limitation of inventory on installation and in its pipelines Offshore installations; emergency shut-down system Offshore installations; fire and explosion protection Offshore installations; temporary safe refuge Offshore installations; limitation of exposure of personnel Offshore installations; formal safety assessment Offshore installations; safety case Offshore installations; use of wind tunnel tests and explosion simulations in design The explosion and fire phenomena Publication of reports in accident investigation
250
Key Lessons Learnt From Major Accidents - Flixborough
In June 1974, a vapour cloud explosion destroyed the nypro cyclohexane oxidation plant at Flixborough, England killing 28 people. Other plants on the site were seriously damaged or destroyed
Key lessons learnt from Flixborough Public controls of major hazard installations Siting of major hazard installations Licensing of storage of hazardous materials Regulations for pressure vessels and systems Limitation of exposure of personnel Design and location of control rooms and other buildings Control and instrumental of plant Decision making under operational stress
The management system for major hazard installations Restart of plant after discovery of a defect Relative priority of safety and production Use of standards and codes of practice Limitation of inventory in the plant Engineering of plants for high reliability Dependability of utilities Security of and control of access to plant Planning for emergencies The metallurgical phenomena Vapour cloud explosions Investigation of disasters and feedback of information on technical incidents
251
Key Lessons Learnt From Major Accidents - Longford
In September 1998 an explosion and fire at the Longford gas plant in Australia tragically killed two men and injured eight workers. The explosion resulted in a two-week gas supply shutdown
Key lessons learnt from Longford Front-line operators must be provided with appropriate supervision and backup from technical experts Improvement of emergency shutdown procedures and process monitoring Increased training for operators in dealing with abnormal conditions Regular reviews of company standards, practice and policies Procedures for identifying hazards should be developed Alarm systems must be carefully designed so that warnings of trouble do not get dismissed as normal Reliance on lost-time injury data in major hazard industries is itself a major hazard Auditing must be good enough to identify the bad news and to ensure that it gets to the top
252
Key Lessons Learnt From Major Accidents - Bhopal
In December 1984, gas leaked from a tank of methyl isocyanate (MIC) at a plant in Bhopal, India. The following morning over 2,000 people were dead and 300,000 injured. At least 7,000 animals perished
Key lessons learnt from Bhopal Public control of major hazard installations Siting of and development control at major hazard installations Management of major hazard installations Highly toxic substances Runaway reaction in storage Water hazard in plants Relative hazard of materials in process and in storage Relative priority of safety and production Limitation of inventory in the plant Set pressure of relief devices Disabling of protective systems Maintenance of plant equipment and instrumentation Isolation procedures for maintenance Control of plant and process modifications Information for authorities and public Planning for emergencies
253
254
Contents
Day 1
Introduction
Day 2
Summary of Day 1
Day 3
Summary of Day 2
Day 4
Summary of Day 3
Day 5
Test
255
256
Accident Investigation Test
257

Accident Investigation Workbook Presenting

Încărcat de

Informații document

Descriere originală:

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Accident Investigation Workbook Presenting

Încărcat de

Drepturi de autor:

Formate disponibile

Effective Accident Investigation for the Process Industries

WORKBOOK June 2005

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Introduction - Venue Arrangements

Fire Alarm, Test and Evacuation

Breaks and Refreshments

Messages and Mobile Phones

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

The overall structure of the training course:

Briefing Why investigate accidents?

Briefing The Investigation Process

Video Piper Alpha Spiral to Disaster

Briefing - Tools and Techniques

Individual Case Study 1

ADL Case Study Part 1a

Briefing Evidence Gathering Part 1

ADL Case Study Part 1b

Briefing Evidence Gathering Part 2

ADL Case Study Part 2

Briefing Introduction to Human Factors

Briefing Introduction to Safety Culture

Briefing Interface Management

Individual Case Study 2

Briefing Emergency Management Planning

ADL Case Study Part 3

Briefing Write-up and Presentation

Individual Case Study 3

ADL Case Study Part 4a

ADL Case Study Part 4b

Review of ADL Case Study & Conclusions

Review of NPC Investigation Reports

Review of NPC Emergency Response Manual

Revision of Key Course Learning Points

Review of Past Major Accidents

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

The time-table for Day 1 is:

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

The time-table for Day 2 is:

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

The time-table for Day 3 is:

The time-table for Day 4 is:

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

The time-table for Day 5 is:

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Arthur D. Little Limited

NPC/20365/142_Accident Investigation Workbook.ppt

Briefing Why investigate accidents?

Briefing The Investigation Process