PSM 22 - Element 17 - Incident Investigation (v4)

Process Safety Management Boot Camp Training
Oil & Gas Skills (OGS)
04 January 2019
DNV GL © 04 January 2019 SAFER, SMARTER, GREENER

Module 17
Incident investigation
04 January 2019
2 DNV GL © 04 January 2019 SAFER, SMARTER, GREENER

Module objectives
 Explain the relevance of incident reporting and investigation for process safety
 Explain the principle of safety triangles
 Explain the sequence and steps of incident investigations
 Provide an overview of analytical investigation technique
3 DNV GL © 04 January 2019

Incident investigation – what is it
 Management must ensure that incidents and 'near hits' are consistently reported and investigated
and that identified actions and learnings are implemented on a timely basis
 Incident investigation is a process for reporting, tracking, and investigating incidents that
includes:
– A formal process for investigating incidents, including staffing, performing, documenting,
and tracking investigations of process safety incidents
– Analysis and trending of incident and incident investigation data to identify recurring
incidents
– Managing the resolution and documentation of recommendations generated by
the investigations

Incident investigation - purpose
 Primary purpose of incident investigations is to improve health and safety performance by:
– Exploring the reasons for the event and identifying both the immediate and underlying causes
– Identifying remedies to improve the health and safety management system by improving risk
control, preventing a recurrence and reducing financial losses
– Define trends in accidents and incidents
– Demonstrate concern

Incident investigation – PSM element expectations (1)
 A system is in place for incident reporting, investigation, follow-up and capturing lessons learned
from incidents and near hits including:
– Injury to people
– Work causal ill health
– Environment incidents
– Damage to assets
– Loss of process containment
– Energy release
– Demands on safety-critical devices
– Business interruption
 The reporting of incidents and near hits by all personnel including contractors and suppliers is
obligatory

 Incidents and near hits are classified and investigated on the basis of actual and potential
outcome
 Incidents and near hits are investigated on a timely basis
 Investigations identify root causes, including human and organizational factors, and
recommendations to address them are identified
 Effective arrangements are in place to ensure that incidents or near hits are appropriately
investigated when they involve contractor or supplier personnel
 There are processes in place to learn from relevant incidents and near hits, and good
practices in other organisations and sectors
 Adequate numbers of competent personnel are available to carry out the required
investigation arrangements
 Completed investigations are reviewed and approved by specific levels of management
appropriate to the classification of the incident

 Senior management periodically reviews the effectiveness of corrective and preventative actions
 Where appropriate and recognising legal and security constraints all stakeholders are kept
informed about the findings and recommendations from investigations
 Recommendations are tracked to completion
 Senior management periodically reviews the effectiveness of corrective and preventative actions

Definitions

Common definitions – adverse events (HSG 245)
 Adverse event includes:

– Accident - an event that results in injury or ill health
– Incident
– Near miss or dangerous occurrence - an event that, while not causing harm, has the potential
to cause injury or ill health
– Undesired circumstance - a set of conditions or circumstances that have the potential to cause
injury or ill health
 Note: “HiPo” commonly used in oil and gas industry. A High Potential (HiPo) incident is an
incident or near-miss that, realistically, could have under other circumstances caused one or more
fatalities

Accident vs near miss
Accident Near miss

Common definitions - consequences or outcome
Fatal Work-related death

Major Accident involving fractures (other than fingers or toes), amputations, loss of
injury/ill sight, a burn or penetrating injury to the eye, any injury or acute illness
health resulting in unconsciousness, requiring resuscitation or requiring admittance to
hospital for more than 24 hours
Serious Injury where the person affected is unfit to carry out his or her normal work for
injury/ill more than three consecutive days
health
Minor injury All other injuries, where the injured person is unfit for his or her normal work for
less than three days
Damage only Damage to property, equipment, the environment or production losses

Definitions of type of accidents and incidents
 In this presentation based on:

– Health & Safety Executive (UK), “Investigating accidents and incidents - A workbook for
employers, unions, safety representatives and safety professionals”, HSG 245, 2004
– Health & Safety Executive (UK), “Reporting of Injuries, Diseases and Dangerous Occurrences
Regulations 1995 (RIDDOR)”
 Note: to be used as guidance, different definitions may apply depending on regulation, standard
or reference document used

Loss causation

Safety triangle
 Safety triangle refers to a ratio which has come to define many safety practices and policy
developments to date: 1 – 10 - 30
– 1 – 10: for every major injury (resulting in death, disability, medical complications or lost
time) Bird found there to be 10 reported minor injuries which required only first aid
– 1 – 30: The meaning of 30 lies in property damage accidents – with approximately thirty of
these occurring per major injury
 Safety Triangle has many other names Bird’s triangle, Heinrich’s triangle or the loss control
triangle

Safety triangle – Frank Bird
 The safety triangle was devised by Frank E. Bird, Jr (ILCI) based on the findings of H.W. Heinrich
in his book, “Industrial Accident Prevention”
 Heinrich established that based on his findings an accident ratio of 1 major injury to 29 minor
injuries, and 29 minor injuries to 300 no-injury accidents existed
 In 1969 Frank Bird looked at nearly 2 million incidents and classified them. Purpose was to see if
there was any connection or correlation between different levels of accidents and incidents. What
he found was that for every single major injury / fatality there were:
– 10 minor injuries
– 30 damage incidents
– 600 no-loss incidents

Modified Bird triangle
1 Serious/disabling injury
10 Minor injuries
30 Property damage
600 Near misses

RIDDOR safety triangle
 RIDDOR compiled this version of Heinrich triangle
1
from their own statistics and shows the relationship
fatal between types of accident reported
 It shows that for every 400 accidents which are
categorized as ‘over 3 days’ there are 60 major
60
accidents and 1 fatality
major
400 Over 3
days
 Note: ”Reporting of Injuries, Diseases and

Dangerous Occurrences Regulations 2013”, often
known by the acronym RIDDOR, is a 2013 statutory
instrument of the Parliament of the United Kingdom

What does the safety triangle teach?
 There are many more incidents than accidents… Health and Safety Executive (UK) 1992 Study
 And many more near misses than incidents…
 The causes and potential are exactly the same…
 Hence lessons learned from near-misses are free!
 Or:
– We cannot afford to ignore incidents just because
there has been no injury, damage or loss
– The likelihood of an accident happening grows with
the number of incidents
In 75% of cases investigated, management was
regarded as wholly or partly responsible for failing to
take reasonably practicable precautions to prevent
the accident

Accident sequence – domino theory
 In the 1930 a safety engineer called H. W. Heinrich developed a theory of accident sequence and
referred to it as the domino theory
 Each domino represents one part of the sequence and if all the parts are present, then when one
of the dominoes falls, it will knock down its adjacent domino until all have fallen
 However if any one domino is removed, the accident is less likely to happen

Loss causation model (isrs)
T
H
Lack of Basic Immediate R
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
• Programme Contr Contr Contr Contr
• Standards Job/System Substandard L
ol
• Compliance olFactors ol
Conditions ol I
M
ol
I
T

T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T

Loss
 Unintended harm to:

– People
– Property
– Equipment
– Process
– Environment
 Note: in case of “near miss” the harm would not have occurred
 For example: person hit by forklift truck

T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T

Incident
 An unintended hazardous scenario or event with the potential to cause harm, immediately
preceding the accident (or near miss)

Example forklift truck
Incidents usually involve contacts:

 Abnormal operations
 Product, process nonconformities
 Customer / stakeholder complaints
 Environmental release
 Struck against (running or bumping into)
 Struck by (hit by moving object)
 Fall to lower level (either the body falls or the object falls and hits the body)
 Fall on same level (slip and fall, trip over)
 Caught in (pinch and nip points)
 Caught on (snagged, hung)
 Caught between (crushed or amputated)
 Contact with (any harmful energy or substance; includes ignition, explosions, emissions, etc.)
 Overstress / overexertion / overload

T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T

Immediate causes
 The most obvious reason why an adverse event happens, generally related to symptoms, hazards
and anomalies
 Note: there may be several immediate causes identified in any one adverse event
Substandard acts • Examples failure to use guards or personal protective equipment (PPE),
/ practices starting machinery without warning, etc.
• These may be accidental acts but could also entail deliberate acts, such
as sabotage and terrorism
Substandard • Environmental conditions such as noise, fumes, space to carry out tasks,
conditions adverse weather conditions offshore, slippery surface etc.
• Situations where operations are not conducted in accordance with defined
procedures or where, in certain situations, those procedures are
themselves unsafe

Substandard acts / practices Substandard conditions

 Failure to warn  Inadequate guards / barriers
 Failure to obey rules  Inadequate PPE
 Failure to follow procedures  Defective tools /equipment
 Removing safety devices  Congestion / disorder
 Improper lifting  Inadequate warning system
 Failure to use PPE  Defective product
 Servicing operating equipment  Excessive exposures
 Failure to identify hazards / risks  Inadequate ventilation
 Failure to communicate / coordinate  Inadequate illumination
 Unethical actions  Inadequate HSEQ exposures
 Failure to analyse, react, and/or correct  Inadequate data / indicators
 …  …
 …  …

T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T
Basic cause = root cause

Personal factors - examples
 Low skill and competence level

 Tired staff
 Bored or disheartened staff
 Individual medical problems
 Attitude towards health and safety (safety culture)
 Being away from home and family (offshore) for long periods of time

Job / system factors - examples
Job factors • Illogical design of equipment and instruments

• Constant disturbances and interruptions
• Missing or unclear instructions
• Poorly maintained equipment
• High workload
• Noisy and unpleasant working conditions
Organisation • Poor work planning, leading to high work pressure
and • Lack of safety systems and barriers
management • Inadequate responses to previous incidents
factors • Management based on one-way communications
• Deficient coordination and responsibilities
• Poor management of health and safety
• Poor health and safety culture
Plant and • How clear and simple to read and understand are the controls
Equipment • If the equipment is designed to detect or prevent errors
Factors • If the workplace layout is user-friendly
• Maintenance procedures
• Operating procedures
• Training and competency arrangements

Personal factors Job/system factors

 Inadequate capability  Inadequate leadership
 Stress  Inadequate engineering
 Inadequate update / refresher training  Inadequate purchasing
 Lack of skill  Inadequate maintenance
 Improper motivation  Inadequate tools and equipment
 Abuse and misuse  Inadequate work standards
 …  Inadequate inspection / monitoring
 …  …
 …  …

T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T

Lack of control
 Lack of control points at deficiencies in the safety management system
 Lack of control is reflected in:

– Inadequate (safety) programme or management system element – key processes are
missing entirely
– Inadequate performance standards – who does what when or how often is not described or
practiced
– Inadequate compliance with standards – the processes and standards are in place but people
are not doing it

Training needs Asset management

 Refresher Training for all personnel in requirements  Inspection of all current FLT tires and brakes
to wear PPE required required
 Management standard / procedure stating when  Management standard / procedure stating when tires
Refresher training is requires also requires review. are to be inspected also requires review
 Performance Standard Inadequate

Investigation incidents

What to investigate?
 All accidents whether major or minor are caused. Near misses should not be ignored either
 Serious accidents have the same root causes as minor accidents as do incidents with a potential
for serious loss. It is these root causes that bring about the accident, the severity is often a
matter of chance
 Accident studies have shown that there is a consistently greater number of less serious accidents
than serious accidents and in the same way a greater number of incidents then accidents
 Note: refer to safety triangles and loss causation model

Analyzing causes (isrs)
T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T
Incident investigation analysis model

Stages in an accident/incident investigation
 Stages in an accident/incident investigation are Deal with

shown in the adjacent diagram immediate
risk
 Note: these are typical steps; actual
accident/incident investigation process in companies
Select level
may vary of
investigation
Investigate
event
Record and
analyse
results
Review
process

Dealing with immediate risks
 When accidents and incidents occur immediate Deal with

action may be necessary to: immediate
risk
– Take control
– Make the situation safe and prevent further Select level
injury of
investigation
– Help, treat and if necessary rescue injured
persons. Ensure first aid and call emergency
Investigate
services event
– Control potential secondary accidents
– Identify and preserve sources of evidence Record and
analyse
– Determine loss potential results
 An effective response can only be made if it has Review

been planned for in advance (i.e. emergency process
response planning)

Selecting level of investigation
 In terms of effort out into the investigation, the Deal with

greatest effort should be put into: immediate
risk
– Those involving severe injuries, ill-health or loss
– Those which could have caused much greater Select level
harm or damage of
investigation
– Impact or risk-based methods based to select
incident investigation (e.g. EI Element 19
Investigate
“Incident reporting and investigation”, Annex E) event
 These types of accidents and incidents demand more
careful investigation and management time. This can
Record and
usually be achieved by: analyse
results
– Looking more closely at the underlying causes of
significant events
Review
– Assigning the responsibility for the process
investigation of more significant events to
more senior managers

Classification of incident
 Example risk-based
classification based on health
and safety risk
 Composition of investigation
team based on risk
 Ref. Energy Institute, “Guidance

on meeting expectations of EI
Process safety management
framework – Element 19:
Incident reporting and
investigation”

Who investigates the incident
 Level of management seniority based

on incident risk determined
 Extract from Ref. Energy Institute,

“Guidance on meeting expectations
of EI Process safety management
framework – Element 19: Incident
reporting and investigation”

Investigating the event
 Purpose of investigations is to establish: Deal with

immediate
– The way things were and how they came to be risk
– What happened – the sequence of events that led
to the outcome (“storybook”) Select level
of
 Why things happened as they did analysing both the investigation
immediate and underlying causes
 What needs to be done to avoid a repetition and how
Investigate
this can be achieved event
Record and
analyse
results
Review
process

Sources for investigation
Interviews
Investigation
material
Documents Observations

Interviews
 Information from:
– Those involved and their line management
– Witnesses
– Those observed or involved prior to the event e.g. inspection & maintenance staff
Guidance:
 Interviewing the person(s) involved and witnesses to the accident is of prime importance, ideally
in familiar surroundings so as not to make the person uncomfortable
 Interview style is important with emphasis on prevention rather than blame. Questions when
asked should not be intimidating as the investigator will be seen as aggressive and reflecting a
blame culture
 Person(s) should give an account of what happened in their terms rather than the investigators
 Interviews should be separate to stop people from influencing each other

Observation
 Information from physical sources including:

– Premises and place of work
– Access and egress
– Plant and substances in use
– Location and relationship of physical evidence and particles
– Any post event checks, sampling or reconstruction
Guidance:
 Accident site should be inspected as soon as possible after the accident. Particular attention
should/must be given to:
– Positions of people and physical evidence
– Usage of Personnel Protective Equipment (PPE)
– Tools and equipment, plant or substances in use
– Orderliness/tidiness

Documents
 Information from:
– Written instructions, procedures, permits, licenses, risk assessments, policies
– Records of earlier inspections, maintenance logs, tests, examinations and surveys before the
event. These provide information on how and why the circumstances leading to the event arose
– Training records, certificates
Guidance:
 Validity of these documents may need to be checked by interview
 Main points to look for are:
– Are they adequate/satisfactory?
– Were they followed on this occasion?
– Were people trained/competent to follow it?

Determining causes
 Collect all information and facts which surround the accident

 Immediate causes are obvious and easy to find. They are brought about by unsafe acts and
conditions and are the active failures (or immediate causes, in loss causation model). Unsafe
acts show poor safety attitudes and indicate a lack of proper training
 These unsafe acts and conditions are brought about by the so called ‘root causes’. These are the
latent failures (or basic causes, in loss causation model) and are brought about by failures in
organisation and the management’s safety system

Determine remedial actions
 Determine what changes are needed: the investigation should determine what control measures
were absent, inadequate or not implemented and so generate remedial action for
implementation to correct this
 Generally, remedial actions should follow the hierarchy of risk control:

– Eliminate risks by substituting the dangerous by the inherently less dangerous
– Combat risks at source by engineering controls and giving collective protective measures
priority
– Minimize risk by designing suitable systems of working
– Use PPE as a last resort

Recording and analysing the results
 Recording provides a historical record of the accident Deal with

immediate
 Recording should be done in a similar and systematic risk
manner
 Analysis of the causes and recommended Select level
preventative protective measures should be listed of
investigation
 Completed as soon after the accident as possible
 Information on the accident and remedial actions
Investigate
should be passed to all supervisors event
 Appropriate preventative measures may also have to

be implemented by such supervisors Record and
analyse
results
 Investigation reports and accident statistics should

be analysed from time to time to identify common
Review
causes, features and trends not be apparent from process
looking at events in isolation

Example incident reporting document (OGP 444)

Reviewing the process
 Reviewing the accident/incident investigation process Deal with

should consider: immediate
risk
– The results of investigations and analysis
– The operation of the investigation system (in terms Select level
of quality and effectiveness) of
investigation
 Follow-up:
– Line managers should follow through and action
Investigate
the findings of investigations and analysis event
– Follow up systems should be established where

necessary to keep progress under control Record and
analyse
results
Review
process

System review
 The investigation system should be examined from time to time to check that it consistently
delivers information in accordance with the stated objectives and standards
 This usually requires:
– Checking samples of investigation forms to verify the standard of investigation and the
judgements made about causation and prioritisation of remedial actions
– Checking the numbers of incidents, near misses, injury and ill-health events
– Checking that all events are being reported

References
 International Association of Oil & Gas Producers (OGP), “Health & safety incident reporting
system users’ guide, 2010 data”, Report No. 444, May 2011
 Energy Institute, “Guidance on meeting expectations of EI Process safety management
framework - Element 19: Incident reporting and investigation”, 1st edition, May 2015

Tools for investigating incidents –
Incident analysis methods

Overview incident analysis methods
 Best practice third-party incident analysis methods used:
– TOP-SET® Root Cause Analysis

– The "5 Why" method
– BlackBox Analysis Diagram
– Tripod Beta
– Incident BowTie
– Fault Tree Analysis
– Event Tree Analysis
– SCAT and BSCAT
 Other, e.g. BP Comprehensive List of Causes (CLC)

Tripod Beta
 Tripod Beta method was developed on the basis of research done in the late 80’s and early 90’s
into human behavioral factors in incidents. The research was commissioned by Shell International
and executed by the University of Leiden and Victoria University in Manchester
 The research question was: ‘Why do people make mistakes?’ The answer to that question was
because organizations expose them to an imperfect working environment. This does not mean
people will not make mistakes when they work in a ‘perfect’ working environment, but it is the
aspects were organizations have control over and therefore can make changes for improvement
 Tripod Beta method analyzes which barriers have broken during an incident, the error or mistake
made, the working environmental aspect that encouraged this and finally the latent failure in the
organization that caused that mechanism

Tripod Beta
 A Tripod Beta analysis process follows three steps:

– Identify the chain of events preceding the
consequences
– Identify the barriers that should have stopped this
chain of events
– Identify the reason of failure for each broken
barrier. This should be broken down in:
– Human failure (Active Failure)
– Working environmental aspects (Preconditions)
– Latent Failure in the organization
 The core of a Tripod analysis is a ‘tree’ diagram

representation of the incident mechanism which
describes the events and their relationships

SCAT
 SCAT = Systematic Cause Analysis Technique

 Based on Loss Causation Model
 SCAT is the formal DNV GL incident investigation technique
– SCAT v8 addresses process safety events
– BSCAT extends SCAT to address barrier analysis
T
H
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
ol
Conditions ol I
M
ol
I
T

Implementation

How to implement
 Refer to Energy Institute, “Guidance on meeting

expectations of EI Process safety management
framework – Element 19: Incident reporting and
investigation”
 Flowcharts for:
– Overall set-up
– Development and use of crisis/emergency
response planning
– Development and use of emergency response
equipment

Principles of BSCAT
Loss causation model applied to barrier

www.dnvgl.com
The trademarks DNV GL®, DNV®, the Horizon Graphic and Det Norske Veritas®
SAFER, SMARTER, GREENER are the properties of companies in the Det Norske Veritas group. All rights reserved.

PSM 22 - Element 17 - Incident Investigation (v4)

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PSM 22 - Element 17 - Incident Investigation (v4)

Uploaded by

Copyright:

Available Formats

Process Safety Management Boot Camp Training

Oil & Gas Skills (OGS)

DNV GL © 04 January 2019 SAFER, SMARTER, GREENER

2 DNV GL © 04 January 2019 SAFER, SMARTER, GREENER

3 DNV GL © 04 January 2019

4 DNV GL © 04 January 2019

5 DNV GL © 04 January 2019

6 DNV GL © 04 January 2019

7 DNV GL © 04 January 2019

8 DNV GL © 04 January 2019

9 DNV GL © 04 January 2019

 Adverse event includes:

10 DNV GL © 04 January 2019

Accident Near miss

11 DNV GL © 04 January 2019

Fatal Work-related death

12 DNV GL © 04 January 2019

 In this presentation based on:

13 DNV GL © 04 January 2019

14 DNV GL © 04 January 2019

15 DNV GL © 04 January 2019

16 DNV GL © 04 January 2019

600 Near misses

17 DNV GL © 04 January 2019

 RIDDOR compiled this version of Heinrich triangle

 Note: ”Reporting of Injuries, Diseases and

18 DNV GL © 04 January 2019

19 DNV GL © 04 January 2019

20 DNV GL © 04 January 2019

21 DNV GL © 04 January 2019

22 DNV GL © 04 January 2019

 Unintended harm to:

 For example: person hit by forklift truck

23 DNV GL © 04 January 2019

24 DNV GL © 04 January 2019

25 DNV GL © 04 January 2019

Incidents usually involve contacts:

26 DNV GL © 04 January 2019

27 DNV GL © 04 January 2019

28 DNV GL © 04 January 2019

Substandard acts / practices Substandard conditions

29 DNV GL © 04 January 2019

Basic cause = root cause

30 DNV GL © 04 January 2019

 Low skill and competence level

31 DNV GL © 04 January 2019

Job factors • Illogical design of equipment and instruments

32 DNV GL © 04 January 2019

Personal factors Job/system factors

33 DNV GL © 04 January 2019

34 DNV GL © 04 January 2019

 Lack of control points at deficiencies in the safety management system

 Lack of control is reflected in:

35 DNV GL © 04 January 2019

Training needs Asset management

36 DNV GL © 04 January 2019

37 DNV GL © 04 January 2019

 Note: refer to safety triangles and loss causation model

38 DNV GL © 04 January 2019

Incident investigation analysis model

39 DNV GL © 04 January 2019

 Stages in an accident/incident investigation are Deal with

40 DNV GL © 04 January 2019