Incident investigation tree

The first case study describes the application of the sequentially timed event plotting (STEP) technique to the incident investigation of a hydrocarbon leak accident. Following the analysis of the event sequence using STEP, the critical event causes are then analyzed using the root cause tree. 

This chapter addresses methods and tools used successfully to identify multiple root causes. Process safety incidents are usually the result of more than one root cause. This chapter provides a structured approach for determining root causes. It details some powerful, widely used tools and techniques available to incident investigation teams including timelines, logic trees, predefined trees, checklists, and fact/hypothesis. Examples are included to demonstrate how they apply to the types of incidents readers are likely to encounter. 

Other examples of inductive tools that have limited application in incident investigation include failure mode and effects analysis (FMEA), hazard and operability study (HAZOP), and event tree analysis (ETA). These are detailed in the CCPS book, Guidelines for Hazard Evaluation Procedures... 

The earliest logic trees were based on engineering fault tree analysis methods. Today, companies use a number of variations or combinations of logic trees and call them by different names, such as Why Tree,< 9) Causal Tree,(20,21) Cause and Effect Logic Diagram (CELD),<22) and Multiple-Cause, Systems-Oriented Incident Investigation (MCS011).<23,24) tools have more similarities than differences. 

Causal Trees were developed in an effort to use the principles of deductive logic found in Fault Tree but make it more user-friendly. Originally, private companies developed the Causal Tree Method (CTM) for safety, process safety, and environmental incident investigations applications. Rhone-Poulenc, for example, was an early user.<20.21) Multiple-Cause Systems Oriented Incident Investigation (MCSOfl) is another name for the CTM. At this time, most companies use simplified versions of fault trees for complex incident investigations. 

Each event, such as equipment failure, process deviation, control function, or administrative control, is considered in turn by asking a simple yes/no question. Each is then illustrated by a node where the tree branches into parallel paths. Each relevant event is addressed on each parallel path until all combinations are exhausted. This can result in a number of paths that lead to no adverse consequences and some that lead to the incident as the consequence. The investigator then needs to determine which path represents the actual scenario. Generally, a qualitative event tree is developed when used for incident investigation purposes. 

The term fault tree means different things to different people. Some people use the term to describe trees that have frequency terms included. These quantitative trees can be solved mathematically to provide a frequency of the incident. However, for incident investigation, the term commonly refers to a qualitative tree. 

Eliminate other distractions from the room if possible. Do not allow the witness to see any documents, such as causal factor charts, fault trees, showing the incident investigation team analysis of the occurrence. This may he appropriate for later interviews when only specific information is needed or a specific time gap is being filled in. 

The next item in the loop is a decision point for possibly introducing the use of inductive reasoning methods into the deliberations. If the deductive process continues to indicate progress, then additional facts are procured or the logic tree is restructured. For example, one witness stated a particular valve was open, yet the post-incident inspection found it to be closed. The team must be careful to ensure that the valve is closed because of the actions taken prior to the incident, and not as a result of post-event response activities. The position of this particular valve may be a critical item in determining which of two scenarios is the more probable case. The incident investigation team would then initiate a short-term action item to conduct a mini-investigation to resolve this question. 

After the most likely scenario has been identified and the logic tree developed, the incident investigation team now reaches the stage of searching out the system-related multiple causes. An accompanying challenge is deciding when to stop further development of each branch of the tree. 

There are a number of quality assurance checks that should be considered when conducting an incident investigation using predefined trees. Most of these checks have already been discussed, but will now be summarized in relation to the corresponding phase of the investigation. 

The next activity in the sequence is to check for completeness, such as, Have all the identified causes been addressed The incident investigation team should remember that the multiple causes are not all necessarily located at the bottom of the logic tree structure. Sometimes causes may be... 

The following case study describes the investigation work process for a hypothetical occurrence using a logic tree based multiple root-cause systems approach. An example incident investigation report follows the work process description. The example is intended for instructive purposes only descriptions of process equipment and conditions are not intended to reflect actual operating conditions. 

As a result of the AIC s efforts, we now have a process for investigating accidents in which we construct an event tree for each incident. The tree is quite similar to a fault tree from the quantitative risk analysis discipline, except that in the investigations we often sacrifice some structural rigor to get the most results in a reasonable time. Basically, the process uses a team to reconstruct the chronology of the incident and to construct the event tree. We try to include those who are most familiar with what actually happened, including the injured person(s) if any. We use the same basic method to investigate process failures, spills, injuries, or any other system failures. Emphasizing the system aspects of the failure removes much of... 

Rohm and Haas uses Multiple-Cause, Systems-Oriented Incident Investigation techniques (MCSOII), or mac-soy. It is a direct adaptation of the Fault Tree Analysis logic and the Deming Principles of Systems and Quality. [10] The method was developed to improve the overall quality of investigations, to increase the uniformity of investigation made by various teams, and improve the usefulness of the proposed corrective actions. The quality of the mac-soy or MCSOII investigation is improved because the method [10]... 

A thorough investigation involving operators, safety coordinator production- and engineering staff resulted in the following verbal description of what had happened the numbers in brackets refer to specific components shown in the graphical description of the same incident, the Incident Production Tree (see figure 1)... 

Each of these investigators is essentially following a Why Tree approach to root cause analysis. Given that there is an indeterminate number of potential chains, no incident investigation team—no matter how well qualified its members may be—can identify every one of those chains. 

While MORT is based on the fault tree method of system safety analysis, its logic diagram does not require statistical entries and computations for event probabilities. MORT is presented as an incident investigation methodology and as a basis for safety program evaluation. 

The structure of the NPSAs Incident Decision Tree is shown in Figure 14.1. Essentially, after the incident has been investigated and some thought given to its causes, a series of questions is asked. Were the actions intentional If, yes, was there an intention to cause harm or not Is there any evidence of a medical condition Was there a departure from agreed protocols and so on. Suppose, for instance, a staff nurse gives a dose of diamorphine to an elderly patient in severe pain without waiting for a prescription to be written. Is this justified Potentially, if there is no other option. Suppose, however, she has made no attempt to contact the relevant doctor. In this case her actions were clearly intentional. 

Integrated approach to the incident investigation requires certain modifications of the meanings of terms predefined tree, Root Cause Map and root cause. The modifications are specified below ... 

There are many various predefined trees in the incident investigation field. Some of them, e.g. the tree predefined in (WANO, 1998) seem to be close to the above described pattern. 

Fault tree An analytical tree used to determine fault. These may be used in accident/incident investigation or to determine accident potential before one has occurred (SSDC). 

The SSHA evaluates hazardous conditions, on the subsystem level, which may affect the safe operation of the entire system. In the performance of the SSHA, it is prudent to examine previous analyses that may have been performed such as the preliminary hazard analysis (PHA) and the failure mode and effect analysis (FMEA). Ideally, the SSHA is conducted during the design phase and/or the production phase, as shown in Chapter 3, Figure 3.4. However, as discussed in the example above, an SSHA can also be done during the operation phase, as required, to assist in the identification of hazardous conditions and the analysis of specific subsystems and/or components. In the event of an actual accident or incident investigation, the completed SSHA can be used to assist in the development of a fault tree analysis by providing data on possible contributing fault factors located at the subsystem or component level. 

WJe now have a process for investigating accidents in which we construct an Event Tree for each incident. The Tree is quite similar to a Fault Tree from the Quantitative Risk Analysis discipline, except that in the investigations we often sacrifice some structural rigor to get the most results in a reasonable time. 

All the hazard analysis and risk assessment techniques previously discussed relate principally to the design process or achieving risk reduction in the operational mode before hazards-related incidents occur. MORT was developed principally for incident investigations. In the Abstract for the Guide To Use Of The Management Oversight And Risk Tree, this is how MORT is described ... 

Since the premise on which the 5 Why concept is based is uncomplicated, it can be adopted easily in the incident investigation process, as some safety professionals have discovered. For the occasionally encountered complex incident situation, starting the investigation with the 5 Why approach may lead to the eventual use of Event Trees, Fishbone Diagrams, or more sophisticated investigation systems. 

---