Incident analysis methods - Wolters Kluwer

Incident analysis methods · Tripod Beta method · Fault Tree analyses method · SCAT analysis method. Thisarticlegivesanoverviewofthe‘bestpractice’incidentanalysismethodsusedindifferentindustries.Thesemethodsare: Contents Whatareincidents? TOP-SET®RootCauseAnalysis The“5Why”method TripodBeta IncidentBowtie FaultTree EventTree SCAT Whatareincidents? Anincidentisanunplannedeventorchainofeventsthatresultsinlossessuchasfatalitiesorinjuries,damagetoassets,equipment,theenvironment,businessperformanceorcompanyreputation.Anearmissisaneventthatcouldhavepotentiallyresultedintheabovementionedlosses,butthechainofeventsstoppedintimetopreventthis.Theseincidentscanbeclassifiedinallkindsofseveritiesandtypes,andthusintocategories.Investigationandcauseanalysisshouldtakethesedifferentcategoriesintoconsideration. TOP-SET®RootCauseAnalysis RootCauseAnalysisisthedrawingofadiagraminwhichtherelationshipsbetweenthecausesofaneventaredisplayed.ThemethodisaimedatfindingtheRootCausesoftheevent.BysolvingtheproblemsdescribedintheRootCausestheprobabilityoftheincident(andothereventsthathavethesameRootCauses)reoccurringislowered.Thiswillpreventtheincidentfromhappeningagain.TheRootCausesAnalysisdiagrammakesadistinctionbetweenthreetypesofcauses:ImmediateCauses,UnderlyingCausesandRootCauses.Theinvestigatormovesthroughthesecausesbyasking‘Why?’untilthelevelofthe‘RootCauses’isreached.Theanswertothe‘Why?’questionisthenextiteminthediagram.ThiscreatesaCause-ConsequencetreethatcanresembleanEventtree. TheTOP-SET®methodisbasedontheRootCauseAnalysismethod.Thisincidentinvestigationmethodology,inwhichtheRootCauseAnalysismethodispartofTOP-SET®incidentinvestigationmethodology,wasdevelopedin1988.Themethodentailsabest-practicewayofdoingincidentinvestigationbasedonyearsofexperienceinincidentinvestigationforcompaniesworldwide.Itincorporatesbothincidentinvestigationandtheanalysisofcomponentstoformacompleteinvestigationprocessthattakestheinvestigatorfromdevelopingateam,gatheringdata,andinvestigatingtogenerateevidence,tointerviewingwitnesses,analyzingevidence,preparingrecommendationsandactions,andreporting.Themethodisusedinover30countriesinmanyindustrialsectors,includingoilandgasproduction,explosives,andtherailtransportandmaritimeindustries. Readmore The“5Why”method The5Whymethodisawayofconductingincidentanalysiswhichisoriginallydevelopedinthe70’sbySakichiToyodaandwaslaterusedwithinToyotaMotorCorporationduringtheevolutionoftheirmanufacturingmethodologies.Itisasimplebuteffectivemethodtofindthecauseofincidents. The5Whymethodisaquestion-askingmethodthatisusedtounderstandthecause/consequencerelationshipsthatunderlieaparticularproblem.Theultimategoalofapplyingthe5Whysmethod,istodeterminearootcauseofaneventorproblem.Theideaistoaskthequestionwhytheeventhappenedandtoaskwhyforthatansweraswelluntilyoureachtherootcauseoftheevent.Originallythemethodprescribesthatfiveiterationsofaskingwhyisgenerallysufficienttogettoarootcause.Butnowadaysasixth,seventhorevengreaterlevelisusedaswell.Thepurposeremainstofindtherootcausetotheoriginaleventthroughanyamountoflevelsofabstractionandtoencouragetheusertoavoidassumptionsandlogictraps.Theanswertothelastquestion,ortherootcauseshouldalwaysbeanorganizationalfactoronasystemicprocesslevel.Toreachthislevelitisadvisabletoaskthequestion‘Whydidtheprocessfail?’insteadofaskingthequestion‘Why?’whenthefifthlevelisreached.Thebackgroundthoughtinthe5whymethodis:“Peopledonotfail,processesdo!".ThismethodiscloselyrelatedtotheCause&Effect(Fishbone)diagram. TripodBeta TheTripodBetamethodwasdevelopedonthebasisofresearchdoneinthelate80sandearly90sintohumanbehavioralfactorsinincidents.TheresearchwascommissionedbyShellInternationalandexecutedbytheUniversityofLeidenandVictoriaUniversityinManchester.Theresearchquestionwas:‘Whydopeoplemakemistakes?’Theanswertothatquestionwasbecauseorganizationsexposethemtoanimperfectworkingenvironment.Thisdoesnotmeanpeoplewillnotmakemistakeswhentheyworkina‘perfect’workingenvironment,butitistheaspectwhereorganizationshavecontroloverandthereforecanmakechangesforimprovement. TripodBetamethod TheTripodBetamethodanalyzeswhichbarriershavebrokenduringanincident,theerrorormistakemade,theworkingenvironmentalaspectthatencouragedthisandfinallythelatentfailureintheorganizationthatcausedthatmechanism.ATripodBetaanalysisprocessfollowsthreesteps: Identifythechainofeventsprecedingtheconsequences Identifythebarriersthatshouldhavestoppedthischainofevents Identifythereasonoffailureforeachbrokenbarrier.Thisshouldbebrokendowninthehumanfailure(ActiveFailure),theworkingenvironmentalaspects(Preconditions)andtheLatentFailureintheorganization. FortheidentificationofthereasonwhythebarriersbroketheHumanErrortheoryiskeptinmind.Itisinvestigatedwhaterrorwasmade,whatfailureintheworkingenvironmentcausedthisandwhatlatentfailurecausedthistobepresent.ThecoreofaTripodanalysisisa‘tree’diagramrepresentationoftheincidentmechanismwhichdescribestheeventsandtheirrelationships. IncidentBowtie The‘IncidentBowtie’methodwasdevelopedbecausetherewasademandfordoingincidentanalysiswithintheBowtiediagram.TheBowtiediagramcontainsalotofinformationaboutthewaysincidentscanhappenandhowtopreventthem.Thereforetoaddinformationaboutactualincidentshasalotofaddedvalue.Thisinformationcan‘prove’theeffectivenessofbarriersandtheprevalenceofThreats,TopEventsandConsequences.Incidentscanalsopointoutifthereareanyholesintheriskanalysis;ifallthescenariosarecovered.IntheIncidentBowtiemethodallthisinformationisdisplayedinonediagram. The‘IncidentBowtie’analysismethodcombinestwoanalysismethods;BowtieriskanalysisandTripodincidentanalysis.Themethodbringstheadvantagesofbothworldstogether.TheinformationfromtheBowtieanalysiscanbeusedasinputfortheincidentanalysis,viewingitfromabroaderperspectiveandmakingsureallthepossiblescenariosaretakenintoaccount.TheinputfromtheTripodincidentanalysiscanbeusedtomaketheBowtieanalysismorerealisticanduptodate,usingreal-lifedata.ItcreatesanextralayerintheBowtiediagram,makingitpossibletoaddmorespecificinformationtotheriskanalysis.Thetwomethodshaveanimportantsimilarityintheanalysistechnique;thebarriers.Forbothmethodsbarriersareusedtoshowwhatisdonetopreventincidentsorevents(Bowtie)ortoshowwherethefailureslie(Tripod).Tobuildan‘IncidentBowtie’diagramtheitemsfrombothmethodsareconnectedonthelevelofthebarriers,makingitpossibletocollectinformationaboutthosebarriersfromtwoviewpoints. AnincidentcanbemappedonanexistingordevelopedBowtieriskanalysisdiagram.Bowtieriskanalysisisaproactivemethodthatmapsdifferentriskscenario’smakingavisualrepresentationofahazardandhowyoucanlosecontroloverthehazard.Thediagramcontainsaleftsidethatrepresentsallthescenarios(theThreats)thatcanleadtotheTopEvent,whichisthemomentcontrolislostovertheHazard.TherightsideofthediagramrepresentsallthescenariosthatcanleadfromtheTopEvent(theConsequences).Foreachscenariobarriersareusedtoshowhowlossofcontrolisprevented.ControlmeasuresshowhowThreatscanbepreventedandrecoverybarriersshowhowConsequencescanbeprevented. TheBowtiemethodismentionedintheguidelinesoftheInternationalAssociationofDrillingContractors(IADC)asapreferredwayofdoingriskanalysisandisthereforeusedinalotofoilandgascompanies.Thesecompaniesmakeuseoftheirpre-definedBowtieriskassessmentstomapincidentson.ThisispossiblewhentheBowtiesarevirtuallycompletewhichallowsforbarriersfromtheincidentanalysistotranslatetothebarriersmentionedintheBowTie.Forcompaniesthatdonothavesuchriskassessmentspredefinedwhenanincidenthappens,theIncidentBowtiemethodismoredifficulttoapply.MakingaBowtieriskanalysisafteranincidenthashappenednarrowsdownthefreethoughtprocessthatisnecessarytopointoutallthepossiblescenariosinaBowtiediagram. FaultTree TheFaultTreeanalysismethodwasoriginallydevelopedin1962atBellLaboratoriesbyH.A.Watson,underaU.S.AirForceBallisticsSystemsDivisioncontract.Themethodreceivedextensivecoverageata1965SystemSafetySymposiuminSeattlesponsoredbyBoeingandtheUniversityofWashington.Inthe70’stheU.S.FederalAviationAdministration(FAA)andtheU.S.NuclearRegulatoryCommissionbeganprescribingtheFaultTreeanalysisasapartofmandatoryriskassessment.Theuseoffaulttreeshassincegainedwidespreadsupportandisoftenusedasafailureanalysistoolbyengineeringdisciplinesasoneoftheprimarymethodsofperformingreliabilityandsafetyanalysis. FaultTreeanalysesmethod SCAT(SystematicCauseAnalysisTechnique)isawidelyusedmethodologyforstructuredanalysisofincidents.ItisaverticalrootcauseanalysisapproachthatincorporatestheDNV‘LossofCausationModel’.Theanalysisisbasedonpredefinedcategoriesoflossevents,theirpotentialdirectandbasiccausesandguidancetowardsamanagementsystemstructureforactionsforimprovement.TheSCATmethodguidestheusersystematicallytoworkbackwardsfromthelosstoidentifywheretheorganizationlackscontroloverdeficienciesthatledtotheoccurrenceoftheincident. AgoodpreparationbeforebuildingtheSCATdiagramistomakeatimelineoftheincident.Thiswillhelpgettingagoodoverviewoftheeventsthatoccurredduringtheincident.Thetimelineisthenbrokendownindifferentsections;choosingthekeyeventsthatwillbeanalyzedintheSCATdiagram.WhentheEventsarechosenacausepathisfollowedthatexplainswhytheincidenthappened.Thecausepathconsistsoffiveitems:theLoss,Event,DirectCause,BasicCauseandLackofControl.ALossisthemainconsequenceoftheincident.Itrepresentsanunintendedharmordamage,forexampledamagedequipment,abrokenarm,lossofproduction,etc. ASCATanalysiscanonlyhaveoneLoss.WhentheuserwantstoanalyzemoreLosses,multipleSCATdiagramsneedtobemade.ALosscanbetheresultofoneormoreEvents.AnEventisahappeningoramomentinwhichthestateoftheincidentchanges.EachEventisanalyzedwithacausechainofthreecausetypes.TheDirectCauseisasubstandardactorsubstandardconditionsthattriggeredtheEvent.Examplesare: Inspectionnotperformedbynewemployee Failuretosecurelift Safetyvalveisbroken TheBasicCausesincludepersonalandjoborsystemfactorsthattogethermadeitpossiblefortheDirectCausetooccur.Examplesare: Maintenancedepartmentunderstaffed Highworkload WearandTear ALackofControlfactorcanbeinadequateprogramstandardsorcompliancetostandardsthatcausetheBasicCausestooccur.Thesefactorsalwaysactonanorganizationallatentlevel.Theywillinfluencearangeofunsafeconditionsandcanthereforecausedifferentincidents.Examplesare: Inadequateleadership Notaskorriskassessments Lackoftraining Thesecausescanbedefinedspecificallyinone’sownwordsorwithuseoftheDNVSCATchart.Thischartgivesalistofgenericdescriptionsforeachofthecauses.PickingthedescriptionsfromtheSCATchartcanbeveryusefulwhencomparingdifferentincidents.Everyuserwillpickfromthesamelistforeveryincident.Foreachcauseleveltherecanbemultipleitemsperincidentexplainingtheevent.Actionsforimprovementcanbemadeoneverycauselevel,butwillbemosteffectiveontheLackofControlcausesbecausethesewilladdressthelatentfailuresintheorganization. FaultTreeanalysisisadeductivereasoningmethod(fromgenerictospecificinformation)fordeterminingthecausesofanincident.AFaultTreeisaverticalgraphicmodelthatdisplaysthevariouscombinationsofunwantedeventsthatcanresultinanincident.Thediagramrepresentstheinteractionofthesefailuresandeventswithinasystem.FaultTreediagramsarelogicblockdiagramsthatdisplaythestateofasystem(TopEvent)intermsofthestatesofitscomponents(basicevents).AFaultTreediagramisbuilttop-downstartingwiththeTopEvent(theoverallsystem)andgoingbackwardsintimefromthere.ItshowsthepathwaysfromthisTopEventthatcanleadtootherforeseeable,undesirablebasicevents.Eacheventisanalyzedbyasking,“Howcouldthishappen?”Thepathwaysinterconnectcontributoryeventsandconditions,usinggatesymbols(AND,OR).ANDgatesrepresentaconditioninwhichalltheeventsshownbelowthegatemustbepresentfortheeventshownabovethegatetooccur.AnORgaterepresentsasituationinwhichanyoftheeventsshownbelowthegatecanleadtotheeventshownabovethegate. EventTree TheEventTreeanalysismethodisusedtoanalyzeeventsequencesfollowingafteraninitiatingevent.Themethodiswidelyusedinmanyfieldssuchasfinance,economics,reliability,riskassessmentandnumerousotherprobabilistictypesofanalysis.EventTreeshelpincreatingaholisticpictureoftherisksandrewardsassociatedwitheachpossiblecourseofaction.Themethodispopularduetoitssimplicity. TheEventTreeanalysismethodisabottom-upinductivemethod.Itmakesuseofgeneralinformationtoanalyzespecificinformation.Thediagramthatisbuiltgivesahorizontalgraphicalrepresentationofthelogicmodelthatidentifiesthepossibleoutcomesfollowinganinitiatingevent.Theeventsequenceisinfluencedbyeithersuccessorfailureoftheapplicablebarriersorsafetyfunctions/systems.Theeventsequenceleadstoasetofpossibleconsequences.Eachcombinationofsuccessesorfailuresofbarriersleadstoaspecificconsequenceorevent.Themethodcanalsobeusedquantitativelytocalculatetheprobabilityofeachoutcomeorconsequencegivingthefailureprobabilityofeachbarrier. AnEventTreebeginswithaninitiatingevent,aTopEvent.Examplesare: Fire Increaseintemperature/pressure Releaseofahazardoussubstance Theconsequencesoftheeventarefollowedthroughaseriesofpossiblepaths.Thepathsrepresentthefailureorsuccessmodesoftheassignedbarriersfortheparticularevent.Eachbarriercanbeassignedaprobabilityoffailure.Examplesofbarriersare: Ignitionprevention Isolation Emergencyresponse Thecumulativefailureprobabilityofthevariousbarriersperpathgivestheprobabilityofoccurrenceforeachoutcomeorconsequence.Examplesofconsequencesare: Financiallosses Explosion Environmentaldamage SCAT TheSCATanalysismethodisdevelopedbyDNVriskconsultancyabout20yearsagoaspartoftheISRS(InternationalSafetyRatingSystem)guidelines.TheSCATversionthatcorrespondswiththe6thversionoftheISRSisdiscussedbelow.Thisversionaddressesafullrangeoflosscontrolevents,howeveritfocusesexplicitlyonoccupationalhealthandsafetyincidents.ThenewestversionoftheSCATmethodfollowingISRS8willbediscussedinthenextsection. SCATanalysismethod SCAT(SystematicCauseAnalysisTechnique)isawidelyusedmethodologyforstructuredanalysisofincidents.ItisaverticalrootcauseanalysisapproachthatincorporatestheDNV‘LossofCausationModel’.Theanalysisisbasedonpredefinedcategoriesoflossevents,theirpotentialdirectandbasiccausesandguidancetowardsamanagementsystemstructureforactionsforimprovement.TheSCATmethodguidestheusersystematicallytoworkbackwardsfromthelosstoidentifywheretheorganizationlackscontroloverdeficienciesthatledtotheoccurrenceoftheincident. AgoodpreparationbeforebuildingtheSCATdiagramistomakeatimelineoftheincident.Thiswillhelpgettingagoodoverviewoftheeventsthatoccurredduringtheincident.Thetimelineisthenbrokendownindifferentsections;choosingthekeyeventsthatwillbeanalyzedintheSCATdiagram.WhentheEventsarechosenacausepathisfollowedthatexplainswhytheincidenthappened.Thecausepathconsistsoffiveitems:theLoss,Event,DirectCause,BasicCauseandLackofControl.ALossisthemainconsequenceoftheincident.Itrepresentsanunintendedharmordamage,forexampledamagedequipment,abrokenarm,lossofproduction,etc. ASCATanalysiscanonlyhaveoneLoss.WhentheuserwantstoanalyzemoreLosses,multipleSCATdiagramsneedtobemade.ALosscanbetheresultofoneormoreEvents.AnEventisahappeningoramomentinwhichthestateoftheincidentchanges.EachEventisanalyzedwithacausechainofthreecausetypes.TheDirectCauseisasubstandardactorsubstandardconditionsthattriggeredtheEvent.Examplesare: Inspectionnotperformedbynewemployee Failuretosecurelift Safetyvalveisbroken TheBasicCausesincludepersonalandjoborsystemfactorsthattogethermadeitpossiblefortheDirectCausetooccur.Examplesare: Maintenancedepartmentunderstaffed Highworkload WearandTear ALackofControlfactorcanbeinadequateprogramstandardsorcompliancetostandardsthatcausetheBasicCausestooccur.Thesefactorsalwaysactonanorganizationallatentlevel.Theywillinfluencearangeofunsafeconditionsandcanthereforecausedifferentincidents.Examplesare: Inadequateleadership Notaskorriskassessments Lackoftraining Thesecausescanbedefinedspecificallyinone’sownwordsorwithuseoftheDNVSCATchart.Thischartgivesalistofgenericdescriptionsforeachofthecauses.PickingthedescriptionsfromtheSCATchartcanbeveryusefulwhencomparingdifferentincidents.Everyuserwillpickfromthesamelistforeveryincident.Foreachcauseleveltherecanbemultipleitemsperincidentexplainingtheevent.Actionsforimprovementcanbemadeoneverycauselevel,butwillbemosteffectiveontheLackofControlcausesbecausethesewilladdressthelatentfailuresintheorganization. BackToTop