1. 1 Incident Investigation Logic Tree Methods Dennis C. Hendershot Rohm and Haas Company, retired SACHE Workshop September 2005 Bristol, PA

2. 2 Purpose of Incident Investigations System improvements System improvements Not choosing scapegoats Not choosing scapegoats You must set the tone! You must set the tone!

3. 3 Logic Tree Start with the incident as the top event Start with the incident as the top event It may be useful to start with a generic top tree It may be useful to start with a generic top tree –Damaging agent in a location –Employee or equipment in location –Employee or equipment in contact with damaging agent long enough to cause  Injury  Damage

4. 4 Generic Top Level Logic Tree for Incident Investigations Injured (or damaged equipment) in contact with Causative agent AND A Injury or Equipment Damage AND Causative agent Present (fire, pressure, chemical) AND B OR Contact with causative agent long enough to cause injury C

5. 5 Logic Tree Choose one second level event Choose one second level event –Determine causes –Draw causing events on logic tree –Keep asking "Why?" and –Draw causes on tree Follow one branch to basic (root) system cause –Includes  Training  Management systems  Culture Repeat for the other events Repeat for the other events

6. 6 "AND" Gate All events entering this box must be true in order for this event to be true Event A Event B AND

7. 7 Test the Logic at Each Step All events entering this box must be true in order for this event to be true Event A Event B AND For each event, ask, “If this event does not happen, would the event above occur?” If no, the event stays as a cause. If yes, the event is not a cause.

8. 8 "OR" Gate If any event entering this box is true, then this event is true Event A Event B OR

9. 9 When to Stop At System Level At System Level –Broader areas affected than this incident –Systems, rather than people Typical: management systems, design systems, training systems When needed expertise is lacking When needed expertise is lacking –May need instrument expert (or vendor expert) to explain why a control device failed a certain way. –May need manufacturer when we can't figure out why cooling tower fan blades are failing.

10. 10 Writing Events Stick to the Facts Stick to the Facts Avoid drawing conclusions Avoid drawing conclusions Clearly label conclusions Clearly label conclusions Indicate direct quotations of witnesses Indicate direct quotations of witnesses

11. 11 Stick to Facts Box Says Box Says –“Goggle area" sign too high to see easily Facts Are Facts Are –Sign is high Conclusions Drawn Conclusions Drawn –Signs cannot be easily seen

12. 12 Determining Causes Generic logic tree Generic logic tree Top level event Top level event Second level events Second level events Keep asking "WHY?" Keep asking "WHY?" "AND" gates "AND" gates "OR" gates "OR" gates Common mode failures Common mode failures System level causes System level causes Test the logic Test the logic

13. 13 Test the Logic Test the logic against the sequence of events and the facts. Test the logic against the sequence of events and the facts. Does the tree support the facts? Does the tree support the facts? –does the tree explain all the facts? Is the tree supported by the facts; Is the tree supported by the facts; are additional facts or assumptions needed to support the tree? are additional facts or assumptions needed to support the tree? The events below each gate must be necessary and sufficient to cause each event The events below each gate must be necessary and sufficient to cause each event If there are gaps, modify the tree or get more facts. If there are gaps, modify the tree or get more facts.

14. 14 Recommendations Look at each bottom level event. Look at each bottom level event. –Attempt to make a recommendation to prevent that event from occurring, or –To mitigate it, if it does occur. Look at structure of tree. Look at structure of tree. –Attempt to add "AND" gates to the tree. Selection basis for recommendations: Selection basis for recommendations: –Protection provided –Frequency of challenge, –Cost of recommendation. Management will address each recommendation and document what was done. Management will address each recommendation and document what was done.

15. 15 Peroxide Drum Explosion 1998 Loss Prevention Symposium Paper 6c

16. 16 MCSOII Logic Tree (1)

17. 17 MCSOII Logic Tree (2)

18. 18 MCSOII Logic Tree (3)

19. 19 MCSOII Logic Tree (4)

20. 20 Logic Tree Advantages More structure More structure Good display of facts Good display of facts Encourages “Out of the Box” thinking Encourages “Out of the Box” thinking Displays cause and effect Displays cause and effect Shows simultaneous events Shows simultaneous events Captures common mode failures Captures common mode failures Shows "AND" - "OR" relationships Shows "AND" - "OR" relationships If keep asking "Why?", can lead to deep system problems If keep asking "Why?", can lead to deep system problems

21. 21 Logic Tree Disadvantages Can get bogged down in discussions about the logic structure Can get bogged down in discussions about the logic structure –Requires good facilitator to manage discussions –If something appears to be important, get it written down somewhere, worry about detailed logic later Logic can become complex, if too rigorous Logic can become complex, if too rigorous Can miss deep cultural issues Can miss deep cultural issues Some background items might not fit easily in the tree (impact many branches) Some background items might not fit easily in the tree (impact many branches)

22. 22 Some Incident Investigation Resources and Articles Book: Book: –Center for Chemical Process Safety (CCPS) (2003). Guidelines for Investigating Chemical Process Incidents. 2 nd Edition. American Institute of Chemical Engineers, New York. Papers and Articles Papers and Articles –Anderson, S. E., and R. W. Skloss (1992). “More Bang for the Buck: Getting the Most From Accident Investigations.” Plant/ Operations Progress 11, 3 (July), 151-156. –Anderson, S. E., A. M. Dowell, and J. B. Mynaugh (1992). “Flashback From Waste Gas Incinerator into Air Supply Piping.” Plant/Operations Progress 11, 2 (April), 85-88. –Antrim, R. F., M. T. Bender, M. B. Clark, L. Evers, D. C. Hendershot, J. W. Magee, J. M. McGregor, P. C. Morton, J. G. Nelson, and C. Q. Zeszotarski (1998). “Peroxide Drum Explosion and Fire.” Process Safety Progress 17, 3 (Fall)), 225-231.

23. 23 Incident Investigation Exercises Incident 1 – Emergency relief system catch tank rupture Incident 1 – Emergency relief system catch tank rupture –Groups 1, 3, 5 Incident 2 – Sodium hydroxide dilution tank eruption Incident 2 – Sodium hydroxide dilution tank eruption –Groups 2, 4