Process Safety Management Boot Camp Training

Oil & Gas Skills (OGS)

20 January 2019

DNV GL © 20 January 2019 SAFER, SMARTER, GREENER

Module 22.1
Element 17 - Incident investigation
Use of BSCAT

20 January 2019

2 DNV GL © 20 January 2019 SAFER, SMARTER, GREENER

Module objectives

 Explain how BSCAT works as investigation tool

3 DNV GL © 20 January 2019

Theory and background

4 DNV GL © 20 January 2019

SCAT

 SCAT is short for “Systematic Cause Analysis Technique”

 Based on Loss Causation Model
 SCAT is the formal DNV GL incident investigation technique
– SCAT v8 addresses process safety events
– BSCAT extends SCAT to address barrier analysis

T
H
Lack of Basic Immediate R
Incident E Loss
Lack
Control Lack
Causes Lack
Causes Lack S
H
Lack
of
Inadequate: of
Personal
Factors
of
Substandard
Acts/Practices
ofEvent O
L ofharm
Unintended
D
Contr
• Programme Contr Contr Contr Contr
• Standards Job/System Substandard L
ol
• Compliance olFactors ol
Conditions ol I
M
ol
I
T

5 DNV GL © 20 January 2019

Systematic Causal Analysis Tool (SCAT) chart

Description of Event
 The existing SCAT chart can be seen to be
simply the Loss Causation Model turned Evaluation of Loss Potential
through 90 degrees
 Loss causation model step “lack of control” is Type of Event
often linked to management systems and is
seen here as “areas for improvement” Immediate/ Direct Causes

Basic/ Root Causes

Areas for Improvement

6 DNV GL © 20 January 2019

BSCAT investigation workflow

 BSCAT adds barrier analysis to SCAT

 This is done through building an
incident barrier diagram
 And includes the use of
bowtie diagram(s)

Building the incident

barrier diagram

7 DNV GL © 20 January 2019

Understand the loss potential

 Before analyzing the incident it is important to understand the outcome:

– Occupational accident
– Slip, trip, fall – not involving hazardous process fluid
– Electrical or hot surface burn etc.
– Process safety event
– E.g. classify according to API RP 754 standard – to allow consistent categorization of events
– Near miss events
– Normal process safety and HiPo events – High Potential / Low Frequency event

 Facilities are designed with many safeguards:

– For an incident some of these must have failed
– In a near-miss event the outcome was terminated but still some barriers will have failed

8 DNV GL © 20 January 2019

Steps to build an incident barrier diagram

 Obtain bowtie accident pathway

 Where to get the bowtie accident pathway from:

1. Base on a risk assessment bowtie if it already exists

– This can be used as the basis for developing an incident barrier diagram
– But it is may be that the risk assessment has not foreseen all relevant interactions
– Use this to derive an incident specific barrier diagram
– This will directly link the risk assessment to the accident sequence
2. Derive it from first principles
– Build the diagram but where possible use barriers that would appear in a risk assessment
– This will indirectly link the risk assessment to the accident sequence

9 DNV GL © 20 January 2019

Identify the hazard, top event, threat and outcome

Getting the framework right is important

 Hazard Potential to cause harm

 Threat The specific initiating event leading towards the Top Event and Outcome
 Top event A clearly identifiable point in the accident sequence where Prevention controls are
replaced with Mitigation controls.
 There is no absolutely correct definition of Top Event – use common sense
 Outcome This is the unwanted final outcome.
In a real incident this is the final outcome, in a near-miss it is the potential
outcome

10 DNV GL © 20 January 2019

BSCAT application

 The BSCAT method requires:

Understanding the
accident – by Applying the SCAT
Creating an
evidence and often method at each
incident bowtie
by construction of stage
timeline

11 DNV GL © 20 January 2019

Example analysis

12 DNV GL © 20 January 2019

Case study

Based on:

 Chemical Safety Board (CSB), “Case study - Heat exchanger rupture and ammonia release in
Houston, Texas”, Report 2008-06-I-TX, January 2011

13 DNV GL © 20 January 2019

Case study - event description

 Goodyear Tire & Rubber Company, Houston, TX, 11 June 11 2008

 Plant produces synthetic rubber, reacting styrene and butadiene
 Reactors are chilled using ammonia refrigeration loop

14 DNV GL © 20 January 2019

Immediate Facts of Event

 Precursors
– Ammonia system failed rupture disk had to be replaced
– Work Permit issued, relief system isolated, rupture disk replaced, isolation remains in place
– Process side tubes needed steam cleaning
– PRV isolated, steam cleaning commences
 Event
– Ammonia in chiller vaporizes, pressure rises, no relief available, pressure burst
 Progression
– Emergency deluge system - worked
– Alarm system failed as all alarm points were inaccessible, radios used instead
– Emergency team fails to operate as a team (one member never accounted for)
– Personnel accounting system fails – manual system used at muster points
– 1 operator nearby – killed by blast / fragments; 5 operators injured by toxic fumes

15 DNV GL © 20 January 2019

Timeline of events

June 10 Day shift

 3:00pm Chiller vessel Rupture Disk bursts
 4:00pm Relief system isolated (using BV)
 4:30pm Rupture disk replaced. BV remains closed
 Night shift June 10/11
June 11 Day shift
 6:30am Chiller vessel isolated, PRV BV’s closed
 7:00am Steam cleaning process side commences
 7:30am Chiller vessel ruptures
 8:40am All company staff accounted for (in error)
 11:00am All contractor staff accounted for
 11:00am Incident declared Over
 1:20pm Fatality discovered (company operator)

16 DNV GL © 20 January 2019

Discussion points for BSCAT barrier sequence

What is the central event? What is the Outcome of the accident bowtie?

a) Maintenance error a) Fatality due to pressure / fragments

b) Vessel loss of containment b) Injury due to toxic gas
c) Vessel pressure burst c) Both of above
d) Faulty process safety management

What is the threat in the accident bowtie?

a) Maintenance error
b) Operator error
c) Emergency team error

17 DNV GL © 20 January 2019

Incident bowtie – threat side

18 DNV GL © 20 January 2019

Incident bowtie – mitigation side

19 DNV GL © 20 January 2019

Apply BSCAT to first barrier

Steam cleaning procedure

Identify the immediate causes:

Substandard act: Improper servicing of equipment

Substandard condition: Presence of harmful materials

20 DNV GL © 20 January 2019

Next develop the basic cause

 Chemical Safety Board (CSB) report does not

specify this aspect in detail, so for the purpose
of this case study we will identify “inadequate
supervision” as the issue

This area of Basic Cause is

Identified, and several aspects
Shown in SCAT diagram might
be applicable

21 DNV GL © 20 January 2019

Finally identify management system “action for improvement”

 Based on the Immediate and Basic Causes

identified, the Actions to improve selected is:
– “Operating Procedures for Controlling Process
Risks”

 The additional columns beside relate to

whether a new standard is needed, whether
the performance standard is inadequate or
whether the issue is compliance to the existing
standard – the CSB report provides no details
to select which

22 DNV GL © 20 January 2019

Incident bowtie – performance during accident

 Threat side Immediate Cause = Green Watchman

System
Basic Cause = Brown
Not implemented
Areas for Improvement = Blue Not a control

23 DNV GL © 20 January 2019

Incident bowtie – performance during accident
PPE
 Mitigation side
Not designed
For this threat

24 DNV GL © 20 January 2019

BSCAT analysis delivery

 Direct linkage to site risk assessment – where bowties are used

– Which barriers failed, partially worked or were successful
– Communicate to control owner
 Direct linkage to safety management system – root cause findings
– Identify areas for improvement
 When printed – can all be fitted onto 1 page
– Concise, but full of content, clearly showing the accident progression
o X X
X X X o

 X X
X X

25 DNV GL © 20 January 2019

BSCAT learnings

 Identified all issues in the CSB report

 Result format is compact, intuitive, and clear
 Placed greater emphasis for operator error in the steaming activity
 Clearer identification of the overlap between Operations and Maintenance
 Clearer definition of the barriers that failed or only partially worked
 Easier to demonstrate a ‘complete’ investigation

26 DNV GL © 20 January 2019

www.dnvgl.com

The trademarks DNV GL®, DNV®, the Horizon Graphic and Det Norske Veritas®
SAFER, SMARTER, GREENER are the properties of companies in the Det Norske Veritas group. All rights reserved.

27 DNV GL © 20 January 2019