Barrier Analysis Worksheet Project

  
Read the U.S. Chemical Safety Board investigation report of the 2007 propane explosion at the Little General Store in Ghent, WV. The final report can be read/downloaded at the following link: https://www.csb.gov/assets/1/20/csbfinalreportlittlegeneral ?13741.

Additional information on the incident, including a video summary, can be found at the following link:

http://www.csb.gov/little-general-store-propane-explosion/

NOTE: This is the same investigation report used to create the events and causal factors (ECF) chart in Unit IV.

Complete the assignment as detailed below.

Part I: From the information in the report, create a three-column barrier analysis worksheet. Use the sample form on page 173 of the course textbook as a template, and follow the instructions below:

a. In the first column, list the barriers. Group the barriers by category (failed, not used, did not exist).
b. In the second column, describe the intended function of each barrier.
c. In the third column, evaluate the performance of the barrier. 

Part II: On a separate page, discuss the potential causal factors that are revealed in the analysis. Are there additional causal factors that were not identified in the ECF chart you created in the Unit IV assignment? This part of the assignment should be a minimum of one page in length.

Upload Parts I and II as a single document. For Part II of the assignment, you should use academic sources to support your thoughts. Any outside sources used, including the sources mentioned in the assignment, must be cited using APA format and must be included on a references page.

References

Kongsvik, T., Haavik, T., & Gjøsund, G. (2014). Participatory safety barrier analysis: a case from

the offshore maritime industry. Journal of Risk Research, 17(2), 161–175. h

ttps://doi-o

rg.libraryresources.columbiasouthern.edu/10.1080/13669877.2012.761275

Pranger, J. (2009). Selection of Incident Investigation Methods. Loss Prevention Bulletin, 209, 1–12.

Participatory safety barrier analysis: a case from the offshore
maritime industry

Trond Kongsvik*, Torgeir Haavik and Gudveig Gjøsund

Norwegian University of Science and Technology, NTNU Social Research Ltd, Trondheim,
Norway

(Received 18 September 2012; final version received 24 November 2012)

This paper argues that a participatory approach directly involving employees in
safety barrier analysis can provide ‘added value’ to traditional barrier analyses.
Employee participation (EP) could motivate employees to use their knowledge,
suggest improvement measures and express their concerns. EP has not received
much attention from safety researchers, although one may find several indirect
arguments for EP informing the influential safety theoretical perspectives. An
example of how participatory safety barrier analysis can be completed and what
can be accomplished through such an approach is illustrated via a case study
from an offshore logistics chain, and by an analysis of barriers that should pre-
vent collisions between supply vessels and offshore installations. Such collisions
could be the initiating event for a major accident. The empirical foundation for
the paper is a hazard identification technique session, group and individual inter-
views, document studies and two search conferences involving approximately
150 participants. It is argued that a participatory approach to safety barrier anal-
ysis can reveal ‘holes’ in the defences that otherwise could have gone over-
looked, and contribute to the generation of contextualized, definite measures
that could strengthen a safety barrier system.

Keywords: barrier analysis; participation; maritime industry; action research

Introduction

Safety barrier analysis is generally regarded as an activity for competent experts, to
be conducted as part of an integrated risk analysis. Fault tree analysis combined
with the identification and scoring of risk-influencing factors are two methods used
toward this end (e.g. Aven, Sklet, and Vinnem 2006; Johnson 1980). This ‘expert
approach’ to safety barrier analysis provides valuable input, informing managers’
decisions regarding measures meant to be risk reducing and preventive.

The establishment, monitoring and maintenance of safety barriers are dependent,
however, on concrete actions taken by all employees, representing all organizational
levels and crossing different barrier types, including technical, organizational and
operational safety barriers. Employees’ actions with regard to barriers rest on their
awareness of the barriers existence, comprehension of their proper functioning and
acknowledgement of the fact that they can exert influence over them.

*Corresponding author. Email: trond.kongsvik@samfunn.ntnu.no

Journal of Risk Research, 2014
Vol. 17, No. 2, 161–175, http://dx.doi.org/10.1080/13669877.2012.761275

� 2013 Taylor & Francis

One important element in successful safety improvement interventions identified
in previous research is the presence of constructive dialogue between sharp-end
workers and management (Hale, Guldenmund, and Loenhout 2010). Employee par-
ticipation (EP) and involvement in safety barrier analysis can serve as a vehicle for
the development and maintenance of safety barriers, as it focuses employee atten-
tion and activates relevant knowledge. This paper will use a case study involving
an offshore logistics chain to illustrate how a participatory safety barrier analysis
can be conducted, and what can be accomplished through such an approach.

The case study contained in this paper examines the offshore logistics chain of
petroleum company operating on the Norwegian Continental Shelf. A major acci-
dent scenario in this activity is collisions between supply vessels and installations.
Such collisions could lead to extensive structural damage, capsizing and, in extreme
cases, extensive loss of life.1 Several layers of safety barriers have been established
to avoid such collisions.

Using a hazard identification technique (HAZID) methodology, documentary
analysis, interviews with 47 different actors in the logistics chain and search confer-
ences involving 152 participants, collision prevention barriers have been identified
and evaluated. These activities laid the foundation for the suggestion of several
measures expected to improve the functioning of the barriers. The participating
actors include onshore and offshore personnel from the petroleum company as well
as crew members on the supply vessels. The study was conducted in the period
from August to December 2011.

Theoretical background

Safety barriers

Safety barriers can be defined as ‘physical and/or non-physical means planned to
prevent, control, or mitigate undesired events or accidents’ (Sklet 2006, 496). They
include physical devices, human actions and administrative procedures meant to
protect vulnerable targets from harm. Functionally, safety barriers perform tasks,
such as preventing vessels from colliding with offshore installations. Such functions
are performed by different barrier elements which, in totality, constitute a barrier
system (Rosness et al. 2010).

A ‘defence in depth’ strategy is commonly applied in the petroleum industry to
prevent the occurrence of major accidents. According to Reason (1997, 12), major
accidents occur as a result of failures in multiple layers of the defences separating
potential hazards from people and assets. Accident trajectories pass through ‘holes’
in these defences, created by active failures – errors and violations – and/or latent
conditions, such as design flaws and unworkable procedures.

We consider several barriers established to prevent collisions between vessels
and offshore installations in the offshore logistics chain studied in this paper. For
analytical reasons, these are divided into two groups: (1) specialized safety barriers,
whose sole purpose is to avoid such collisions and (2) generalized safety barriers,
which serve differentiated potential functions, including collision prevention.

Employee participation

EP2 in decision-making is a core element of a healthy corporate democracy. Histori-
cally, EP has been regarded as a vehicle for societal change and crucial for the

162 T. Kongsvik et al.

development of democratic values in general, as employees spend so much of their
time in work environments (Pateman 1970). It has also been regarded as a means
of improving working conditions and counteracting feelings of alienation on the
part of workers (Blauner 1964).

The initial use of EP in a political and emancipatory fashion has since been
supplemented by an organizational approach. EP is claimed to have the potential to
increase work quality and productivity, as well as job satisfaction. Incorporating EP
could motivate employees to use their knowledge, suggest improvement measures
and express their concerns, as it meets certain basic human needs, such as self-
actualization, social belonging and meaning (Sashkin 1984).

The effectiveness of EP will vary with the circumstances of its implementation.
When first adapted from a health-promotion context (Jacobs 2006; Pretty 1995),
five different levels were identified with increased employee influence on the pro-
cess and end result: (1) participation by information, where employees are informed
of an impending safety intervention by the employer, and can ask questions; (2)
participation by consultation, where employees’ opinions on an intervention are
solicited, but the employer makes the final decision as to the best course of action
to pursue; (3) functional participation, where employees are involved in developing
the intervention, but the employer retains control over the process; (4) interactive
participation, where employees and employer are equal partners in defining prob-
lems and devising strategies to address them; and, (5) self-mobilization, where
employees organize an intervention and employers support it if asked.

Regardless of the level of EP, research shows that it should not be regarded as a
‘magic formula’ capable of solving all problems in an organization, including issues
related to health, safety and the environment (HSE). Remmen and Lorentzen (2000)
found that, when implemented in an industrial context for pollution prevention, EP
could lead to positive changes in work routines, behaviour and environmental con-
sciousness, but that such effects varied considerably between enterprises, based on
their traditions of cooperation, mutual respect and the level of importance given to
HSE issues. As EP demands knowledge, experience and training, and a level of
maturity on both the individual and organizational level (Pasmore and Fagans
1992), it seems that different structural, relational and social hindrances could limit
the potential of EP in HSE work.

EP in the context of safety theories

Participation and involvement by employees in safety barrier analysis is a topic that
has not received much attention from safety researchers. While reference to this
specific issue is rare in the safety literature, several indirect arguments favouring
such an approach inform many of the most influential theoretical perspectives. In
the following, some of these arguments will be identified, in order to ground our
approach in existing safety theories. We also articulate a common aspect of these
different theories.

The logistics chain we present here may be considered a sociotechnical system,3

and one may think of different strategies for describing such systems and their
safety barriers. They may be described structurally, i.e. by the way they are
designed and by formal descriptions of technologies and work processes as theoreti-
cal representations. Alternatively, they may be described substantially, i.e. by the
way they appear and are managed in practice. The structural description may be

Journal of Risk Research 163

informed by governing documentation, technical descriptions and interviews with
managers and designers. In substantial descriptions such as those adopted in this
study, the methodology could include observation of the work actually being done
and interviews or workshops with the people involved and participating in the sys-
tem. The participation and involvement strategy characterizing the current study is
argued for by multiple theoretical perspectives.

Structures are merely resources for action

Suchman (1987, 130) has richly documented the significant difference between the
structure and substance of sociotechnical systems using the terminology of plans
and situated action. One of her main arguments is that plans – representing struc-
tures – do not determine action, they merely represent resources for action, since
action is always situated in a sociotechnical, dynamic system and must be con-
stantly adjusted to fit ever-changing conditions. When transferred to the context of
evaluating barriers against collisions between vessels and offshore installations, and
when adopting the term ‘living barriers’ (Rosness, personal communication; see also
Rosness et al. 2008), one might claim that it is not sufficient to consider only the
work process/flow chart descriptions of barriers; one must also consider the way the
barriers in the system are enacted. A focus on the enactment of technical, human
and organizational barriers is further indicative of a sociotechnical perspective in sit-
uations where even the most technical barrier exists in a social context – that is, in
relation to other technical, human or organizational factors – and the function of
that barrier is shaped by those larger relationships.

Sociotechnical systems are reflexive

According to Reason, a safe culture as an informed culture implies,

… one in which those who manage and operate the system have current knowledge
about the human, technical, organizational and environmental factors that determine
the safety of the system as a whole. (Reason 1998, 294)

Reason thus underscores the reflexive dimension of a sociotechnical system. A
consequence of this perspective is that a system may not be able to be objectively
described from the outside, since the knowledge of its operators influences its
performance, including the performance of its safety barriers. The argument is
closely connected to Suchman’s view in the sense that the system is not defined
solely by its structural description: the knowledge of those who manage and operate
the system makes a difference to the actual constitution – and thus the safety – of
the system, since they are themselves parts of the system. This knowledge is
seldom included in structural, external descriptions. To describe and evaluate this
knowledge, it is necessary to go to its source: the employees.

Work is characterized by trade-offs between efficiency and thoroughness

Although standards and guidelines informing the operation of a system are meant to
be reflected in the actual operation of a sociotechnical system, modifications to
instructions and rules violations are frequent even in highly constrained high-risk

164 T. Kongsvik et al.

environments such as nuclear power plants (Hollnagel 2009, 359; Leveson 2004,
369). Although such actions may be seen as deviations and human errors that may
cause accidents, in whole or in part, such behaviour can also be interpreted as both
rational (Leveson 2004, 369) and normal (Hollnagel 2009, 359). Hollnagel has
coined the term ‘efficiency-thoroughness trade-off’ as a means of explaining the
rationale for normal performance variability. The point is that, in order to manage a
sociotechnical system and to accomplish the goals in a timely manner, it is often
necessary to deviate from prescribed work practices. Such adaptations influence the
system and, if the ambition is to produce an accurate and relevant description of a
system and its barriers, this may be taken as an argument that the descriptions need
to be informed by the operators.

High reliability may attributed as non-explicit, cultural traits

In the aftermath of the Three Mile Island nuclear accident in 1979, and Perrow’s
subsequent development of Normal Accident Theory (Perrow 1984, 65), a group of
researchers initiated a study on industries and organizations exhibiting a remarkably
good safety record considering the high-risk nature of the involved processes (La
Porte 1996, 371; La Porte and Consolini 1991, 395; Roberts 1990, 292; Rochlin,
La Porte, and Roberts 1987, 163; Weick 1987, 243). Research into these organiza-
tions resulted in several characteristics seen as explanatory for the extraordinary
safety performances of these organizations and industries. One set of such character-
istics – labelled the five elements of mindfulness (Weick and Sutcliffe 2001), are:
(1) a preoccupation with failure, (2) reluctance to simplify, (3) sensitivity to opera-
tions, (4) commitment to resilience and (5) deference to expertise. While Perrow
explained safety conditions in terms of structural and technical characteristics; high-
reliability organizations’ research has shown that a safe outcome cannot be
explained by static, technical descriptions of the processes. The ways in which
humans – whether individuals or groups – think, act and collaborate during both
normal operations and in crisis situations are found to have a decisive effect on the
outcome of operations. These properties may not be evident in formal descriptions
of the organization, since they are cultural traits that may not even be explicitly
known to the organization itself, and since they are not necessarily so stable as to
be immune to change as a result of practical drift (Snook 2000, 148) or the normal-
ization of deviance (Vaughan 1996, 174). The identification of these characteristics
– and, in turn, of the safety condition of the system and its barriers – may thus ben-
efit from in-depth studies, including interviews and observation of actual work.

Barriers are sociotechnical constructs

Barriers such as those preventing collisions between vessels and offshore installa-
tions may be categorized as either or both material or social.4 As indicated above,
however, there is rich documentation of the fact that few phenomena in sociotechni-
cal systems may be regarded as purely material/technical or purely human/social. A
barrier will always exist in a context and its use will be situated, that is, its function
depends on circumstances that are not static and that thus may not be statically
described.

Rochlin’s (1999, 233) reference to safety as a social construct is, perhaps, an
exaggeration of the significance of the social at cost of the material, as purely social

Journal of Risk Research 165

phenomena are as rare as purely material phenomena (for an elaboration on this
perspective, see e.g. Latour 1992, 287). Rochlin’s reference does, however, direct
attention toward the point made here – namely that, in order to map and evaluate
the function of barriers within a sociotechnical system, it is necessary to be
informed by those who actually operate or are in different ways involved with the
barriers in the actual, practical work. The existence, condition and function of these
barriers depend on the knowledge and actions of these people.

As a result, the durability of barrier analyses in sociotechnical systems can be
limited. Even if the technical systems and the written procedures remain unchanged,
the practices constituting the barriers may change due to practical drift, normaliza-
tion of deviance, changing efficiency requirements or deteriorating knowledge, to
mention just some of the points of concern noted in the relevant literature.

What we have aimed to illustrate in this theoretical section is that safety barriers
may be seen as sociotechnical entities that are constructed and reconstructed
through their daily exercising. This implies that an analysis of safety barriers based
on formal descriptions alone will be insufficient and misrepresentative. Through EP
and involvement, safety barrier analyses may take into account the context, the situ-
atedness, the enactment, the reflexivity, the trade-offs and the cultural influence on
the shaping, function and effectiveness of the barriers.

The case: Identification and evaluation of safety barriers

The offshore logistics chain

Offshore installations have continuous need for equipment and bulk products used
in petroleum production, supplies of food and water, as well as the off-loading of
waste and environmentally dangerous by-products to be relocated to onshore pro-
cessing facilities. The logistics chain established for these purposes includes multi-
ple actors (Figure 1).

The supply bases, located along the Norwegian coast line, are responsible for
preparing outgoing cargo and loading it onto supply vessels, as well as the handling
of return cargo. In cooperation with the vessels and installations, the supply bases
plan the placement of cargo and the route, to ensure efficient deliveries and reduce
the time spent loading and unloading alongside installations. The supply vessels are
contracted from different ship owners, and are responsible for the safe and timely
transportation of cargo to and from the locations. The offshore installations load
and unload cargo in close cooperation with the vessels. The operator’s Maritime
Traffic Control (MTC) monitors vessel activities, and ensures they are not on a col-
lision course with the installation. The MTC also coordinates the activities, for
instance, re-routing vessels if special needs for equipment should arise on any given
installations. The Maritime Administration Unit is located onshore, and is responsi-
ble for the procurement and follow-up of the vessels and their ship owners – seeing
to, for instance, the satisfaction of technical and operational requirements, as well
as the overall safety and efficient functioning of the logistics chain.

The risk picture

The Petroleum Safety Authority in Norway (PSA) has defined two situations which
carry potential for major accidents involving vessels and offshore installations, and

166 T. Kongsvik et al.

require that petroleum companies have emergency preparedness plans in place to
handle these situations, should they occur (PSA 2011):

• Vessel on collision course.
• Collision with field-related vessel/installation/shuttle tanker.

There have been 26 collisions between offshore service vessels and installations
in the period from 2001 to 2010 on the Norwegian Continental Shelf. According to
the PSA, six of these events had a very high major accident potential (PSA 2011).
The PSA calls attention to the fact that supply vessels are getting larger, while off-
shore installations have not been redesigned to withstand the kind of energy a colli-
sion is now capable of releasing. Previous investigations revealed complex causes
contributing to these collisions, including human error, organizational factors and
failure of technical equipment. Responsibility for the incidents has been addressed
to several actors in the logistics chain, including operating companies, ship owners
and crews (PSA 2011).

Even though analyses of these collisions have been conducted, the PSA (ibid)
still claims that: ‘Good collision analyses will not increase safety if they become
only an academic exercise … The analyses are rarely used as a basis for reducing
risk. Here, we see a need for improvement’. This study can be seen as an answer to
the PSA’s perceived need for better and more relevant information in order to
reduce the risk for collisions between vessel and installation. By reviewing collision
preventive barriers, and by evaluating the quality of them in interactions with actors
throughout the logistics chain, it will be possible to reveal the potential for
improvement.

Figure 1. Actors in the offshore logistics chain.

Journal of Risk Research 167

The participatory activities

The study was completed in four steps: (1) identification of collision preventive
barriers, (2) evaluations of their functioning, (3) analysis and (4) identification of
measures. The approach included three different participatory activities (Figure 2).

In addition to using participatory methods, relevant documents and statistics
from the petroleum industry were studied in the initial phase, in order to gain a
foundation of knowledge and a solid understanding of the phenomenon. Industry
regulations, descriptions of work processes and steering documentation from the
petroleum company and various statistical sources have been used for this purpose.

HAZID

The goal of the HAZID is to identify potential hazards connected to a specific situa-
tion, project, etc. A HAZID is usually organized as a workshop involving experi-
enced personnel from different areas relevant to the topic at hand. Checklists of
HSE issues are applied as aids in the discussion and identification of relevant topics
and methods (Jansen et al. 2001).

A HAZID technique was used here to identify hazards relevant to vessel-instal-
lation collisions. Collision preventive barriers and their relative strengths and weak-
nesses were also discussed. Ten experienced representatives from the different parts
of the logistics chain (see Figure 1) were present. The group worked together for
one day, producing a list of potential hazards, collision preventive barriers and risk-
influencing factors.

Qualitative interviews

Qualitative interviews are characterized by open-ended questions designed to elicit
in-depth responses about people’s experiences, perceptions, opinions, feelings
and knowledge (Patton 2002). The most common qualitative interview is the

Figure 2. Participatory activities for the identification, evaluation and development of
collision preventive safety barriers.

168 T. Kongsvik et al.

semi-structured interview, used when the researcher knows which themes are to be
studied, but answers revealing unexpected perspectives are also of value (Kvale
2001). In most instances, an interview guide is used as an aid to ensure the capture
of all themes of interest to the researcher or project.

Our intention with the interviews in this study was to evaluate the barriers iden-
tified by the document study and the HAZID. Our semi-structured interview guide
consisted of themes we felt would provide insight into and knowledge of the colli-
sion preventive barriers. The structure was nearly identical for all interviews, with
some variations in emphasizing the different barriers depending on what activities
were most relevant to the informant.

A total of 47 persons were interviewed, both individually and in groups. Most
respondents were interviewed face-to-face, except those working on offshore instal-
lations who were interviewed by phone. All interviews were recorded, partly tran-
scribed and then categorized according to the activities and barriers discussed.

The interviews provided information on the functioning of the barriers identified
in previous research activities, and gave us new insights into other aspects of the
different actors’ daily work. We also considered the quality of the barriers in a
holistic way during the analysis; well-functioning barriers for one actor were not
necessarily adequate in the eyes of other actors across the logistics chain.

Search conferences

A search conference is a method of collective problem-solving, generally involving
a large group of people and planned by a facilitating research group. Depending on
the topic, participants are invited based on their roles in current work processes and
organizational belonging. The selection of participants should reflect a diversity of
perspectives on the issues addressed. A search conference is based on a combina-
tion of discussions in smaller groups and plenary discussions organized by a staff
of experienced facilitators. It starts with the presentation of different views on the
problem at hand, and proceeds with creative problem-solving and the generation of
a mutually agreed upon action plan (Greenwood and Levin 1998).

We arranged two search conferences on behalf of the operating company, each
lasting two days and involving a total of 152 participants representing all parts of
the logistics chain. The conferences were structured so that the first day was
devoted to discussing collision preventive barriers and measures to strengthen them.
The findings from the HAZID and the semi-structured interviews were presented to
participants, followed by group discussions concerning the challenges and possible
measures. This was followed by a plenary discussion on the second day, where the
assembly reached a consensus on what measures that should be prioritized.

Results and suggested measures

The document review, the HAZID and the interviews provided an overview and
assessment of the barriers. These were then used as a point of departure for the sub-
sequent search conference.

Our primary impression prior to the search conference suggested the existence
of a multitude of largely adequate collision preventive barriers. Many of these had
been established in the last decade, and were associated with activities taking place
at different parts of the logistics chain: procurement and follow-up of vessels,

Journal of Risk Research 169

supply base activities, sailing, entrance into the installations’ safety zone, loading
and unloading and departure from the safety zone. Thirty-two specialized and gen-
eralized barriers were identified and evaluated, a majority of which were located at
the ‘sharp end’ of operations, where collisions were most likely to occur. Examples
of the barriers identified are presented in Table 1:

A review of earlier collisions conducted by authorities responsible for the Naval
Control of Shipping showed that they were not associated with breakage of individual
barriers or even a series of individual barriers, but rather the concurrent breakage of
several independent barriers. We are thus reminded of Hollnagel’s (2009) point that
normal performance variations resulting from efficiency-thoroughness trade-offs may,
under certain conditions, coincide with and give rise to a resonance effect that can con-
tribute to accidents, as the FRAM model (Hollnagel and Goteman 2004) illustrates.

Predicting all possible combinations of barrier failures is clearly challenging. A
more basic strategy capable of contributing to a reduction in the probability of colli-
sions is to ensure the quality of the individual barriers. Various means of strength-
ening these barriers in relation to three specific aspects of the operations were
suggested:

Competence in using the dynamic positioning system

The dynamic positioning system (DPS) as a technological system combines data on
navigation, wind, currents and vessel movements, and computes the power needed
for the propellers so that the vessel can remain stationary, for instance, while load-
ing or unloading cargo at an offshore installation. Such systems have become
increasingly automated, complex and reliable in recent years, paradoxically leading
to navigators receiving less training in handling these situations in the case of DPS
errors or malfunctions. More training under controlled conditions was thus a
primary desire voiced by numerous stakeholders. Such training would address an
important weakness of the otherwise largely reliable DPS barrier.

Table 1. Examples of identified collision preventive barriers.

Activity Collision preventive barriers Type of barrier

Loading/unloading at
installation

The DPS

Specialized

Manning with two navigators on bridge Specialized
Considerations of weather criteria (maximum
wind, waves) during operations

Specialized

Entering the installations’
safety zone

Reviewing checklists on bridge and in engine
room

Specialized

Risk assessment when operations are planned
on windward side of installation

Specialized

Sailing to installation Surveillance from the operators’ MTC Specialized
Waypoint setting outside the installations’
safety zone

Specialized

Supply base activities Planning of sailing route and placement of
cargo on vessel (reduce time spent alongside
installation)

Generalized

Procurement and follow-
up of supply vessels

Considerations of the vessel’s technical
conditions according to requirements
(redundancy, design, etc.)

Generalized

Considerations of the crews’ qualifications
relevant to requirements (certificates, etc.)

Generalized

170 T. Kongsvik et al.

A lack of redundancy in the DPS reference system

The second aspect identified as having potential for improvement was the point that
several installations lack redundancy in their DPS reference system, relying only on
Global Positioning System receivers for positioning in the case of DPS malfunction.
These signals are occasionally lost during loading and unloading, increasing the
probability that a ship drifts into an installation. Redundancy may be achieved by
setting up a RADius or FanBeam system5 on the installations, representing a
relatively cheap and easy intervention.

Late requests to change loading and sailing plans

The third aspect identified as bearing potential for improvement was the need to be
more restrictive in accepting late requests for changes to loading and sailing plans.
Possibly a result of bad planning, installations occasionally would make such
requests during or just after the loading of the vessels, while the vessels were
already en route. Such changes introduced potential difficulties, as the vessels were
loaded according to a specific unloading sequence and specific route between the
different installations. Late changes increase the number of calls made by a ship,
and often extend the time vessels spend alongside an installation, thus increasing
the risk for collisions. Instead of simply being more restrictive in accepting late
changes, all parties can adopt a progressive strategy by arranging for more involve-
ment by all stakeholders, and especially the installations, in compiling shipping
plans, as opposed to simply asking approval once the plans have been set.

Discussion

This paper has sought to illustrate that safety barrier analysis, usually an activity
reserved for safety experts, could involve employees from the blunt to the sharp
end in a sociotechnical system. With such an approach, ‘holes’ in the defences
(Reason 1997) can be revealed that otherwise might have gone overlooked; fuller
EP could also lead to the generation of definite measures that could strengthen a
safety barrier system. A truly participatory approach could support safety motivation
and ‘mindfulness’, too, as it satisfies certain basic human needs, such as self-actual-
ization (Sashkin 1984; Weick 1987).

Participatory methods can be used both in assessing the current ‘state of the art’
and for the ‘promotion of change’ (Menckel 1993, 7). The participatory process
may assume different forms, but the basic tenet is to involve all stakeholders in
interpreting results (Ibid., 240). In doing so, we were able to gain insight into stake-
holders’ differential experiences of existing barriers. This broad involvement can,
on its own, increase awareness among participants as to the actual work methods
and risk picture, thereby preventing collisions between vessels and installations.
The PSA (2011) asks for supplements to traditional collision analyses as part of
their efforts to reduce the numbers of collisions between offshore installations and
vessels. The approach presented here is one possible direction to follow, a means of
providing additional insight into barrier systems.

Two guiding principles can be identified in our interpretation of participatory
barrier analyses: (1) meet complexity with broad involvement and (2) triangulate
participatory methods.

Journal of Risk Research 171

Meeting complexity with broad involvement

As illustrated, an offshore logistics chain is a complex sociotechnical system involv-
ing different actors, including the operator and contactors who interact with each
other and different technologies. A barrier system has been established in order to
avoid collisions. This system includes a range of barrier elements placed at different
parts of the logistics chain. The functioning of the safety barrier system is also
dependent on people, whether directly – as in the surveillance of vessels on a colli-
sion course with an installation – or indirectly, as in the testing of technological
systems. As a result, collisions will and do have complex causes, as the failure of
an effective barrier system presupposes the concurrent breaking of several barriers.
This is due in no small part to the sociotechnical processes involved in enacting
these barrier systems.

One way to deal with this complexity and the interdependencies is to arrange
for ‘requisite variety’ (Morgan 1998), i.e. broad involvement from the different
stakeholders in efforts for strengthening the barrier system as a whole. Such stake-
holder involvement would be expected to include and allow for considerations
over how barriers are enacted (Suchman 1987), and their rationale for normal
performance variability, such as that caused by efficiency-thoroughness trade-offs
(Hollnagel 2009).

The involvement of key stakeholders can also provide a foundation for an
informed culture (Reason 1998), where managers and operators are provided with
insight into factors influencing the efficacy of the system. This could be particularly
relevant considering the complexity of logistics chains, as such factors are often
controlled or greatly influenced by outside actors, and thorough oversight in general
is difficult to achieve. Such broad involvement could also provide input to and
ensure the proper use of intelligent transportation system technologies, which
give new opportunities for overview, coordination and user orientation (Ran et al.
2012).

Triangulation of participatory methods

The participatory methods used here, including HAZID, individual and group
interviews, and search conferences (Figure 2), served different yet complementary
purposes. The HAZID served as an aid in identifying hazards and situations where
collisions could occur. This provided an important foundation for the subsequent
identification and evaluation of collision preventive barriers, accomplished largely
through qualitative interviews and document analyses. Lastly, the search
conferences allowed the analysis of the empirical data collected by the researchers
to be presented and discussed by in excess of 150 participants, facilitating the
development of measures that will strengthen existing barrier systems.

Although several potentially appealing aspects of participatory safety barrier
analyses can be identified, the project also raises certain uncertainties regarding the
long-term positive effects such analyses will introduce. First, the level of participa-
tion is functional (Jacobs 2006), implying that the actual power to make the sug-
gested improvements remains in the hands of the management. As the study was
completed in December 2011, there is some uncertainty around whether the
measures will be implemented. If no changes occur, one can envision this having a
negative effect, de-motivating against further involvement and participation. Second,

172 T. Kongsvik et al.

although key stakeholders were involved in the analysis, the project could not
include all employees throughout the logistics chain for practical reasons. Some
were directly consulted, some were indirectly informed by others and still others
likely remained wholly unaware of the project. While this might limit the value of
this study, total involvement will seldom be possible, and the level of participation
in this project was sufficient for us to assume that such a project can stimulate
positive changes.

Further research is clearly needed to follow up on the consequences of
participatory barrier analyses in terms of increased safety. One issue to consider is
the significance of the level of participation. In this particular project, employees
were consulted and involved in the development of measures, although the
operator retained ultimate responsibility for the implementation and oversight of
safety procedures. Participation could be considered functional, but it is unclear as
to whether or not this level of involvement is sufficient to induce potent
measures, awareness and appropriate actions, or if a more extensive, interactive
participatory approach is required. It is also unclear if, and if so, to what extent a
participatory approach strengthens the barriers and reduces the occurrence of
incidents? Qualitative research methods could be used to explore such questions,
possibly in combination with quantitative methods.

Conclusion

We have illustrated how non-experts can be involved in safety barrier analysis by
using an array of methods. A participatory approach allows for the collection of
knowledge and experiences from different actors, which can then be applied in sub-
sequent analyses. Although the methods by themselves are not unique, the combina-
tion creates a foundation for concrete, contextualised measures that can strengthen
the efficacy of barriers and increase the safety level. This might also contribute to a
general awareness of the barriers on the part of the different actors, and of how
individuals can contribute to the proper functioning of those barrier systems.

Acknowledgements
The authors wish to thank our research colleagues at Studio Apertura and in particular Rolf
Bye, Jørn Fenstad, Marit Schei Olsen and Kristine V. Størkersen. The comments from the
two anonymous reviewers were greatly appreciated. We would also like to thank
the participating seafarers and the operating company for their interest and goodwill during
the project period. The work on this paper is partly funded by the Research Council of
Norway and the programme Safety and security in transport (TRANSIKK).

Notes
1. One example is the Mumbai High North accident in 2005, where 22 persons died and

the platform was lost after a collision with a multi-purpose support vessel ignited a dev-
astating fire (Mitra, Dileep, and Kumar 2008).

2. Participation can be defined as a process in which influence is shared among individuals
who are otherwise hierarchically unequal (Wagner 1994, 312).

3. Sociotechnical systems, as used here, refers generally to any process or entity that con-
sists of and relies on elements traditionally thought of as belonging to both the social
and the technical, or material, domain. It does not refer to any programmatic definitions,
such as the Tavistock programme, where sociotechnical system theory was focused on
discerning ‘the best match between the technological and social components’ (Trist
1981).

Journal of Risk Research 173

4. An alternative terminology may be physical, technical and human/operational.
5. These are commercial products that use reflected laser or radar signals as aids for mea-

suring position relative to an offshore installation.

References
Aven, T., S. Sklet, and J.E. Vinnem. 2006. Barrier and operational risk analysis of hydrocar-

bon releases (BORA-Release): Part I. Method description. Journal of Hazardous Materi-
als 137: 681–91.

Blauner, Robert. 1964. Alienation and freedom: The factory worker and his industry.
Chicago, IL: University of Chicago Press.

Greenwood, D.J., and M. Levin. 1998. Introduction to action research: Social research for
social change. Thousand Oaks, CA: Sage.

Hale, A.R., F.W. Guldenmund, P.L.C.H. Loenhout, and J.I.H. Oh. 2010. Evaluating safety
management and culture interventions to improve safety: Effective intervention strate-
gies. Safety Science 48: 1026–35.

Hollnagel, E., and O. Goteman. 2004. The functional resonance accident model. In Proceed-
ings of cognitive system engineering in process plant, 155–61.

Hollnagel, E. 2009. The etto principle: Efficiency-thoroughness trade-off: why things that go
right sometimes go wrong. Aldershot: Ashgate.

Jacobs, G. 2006. Imagining the flowers, but working the rich and heavy clay: Participation and
empowerment in action research for health. Educational Action Research 14: 569–81.

Jansen, S., P. Brett, J. Kohnert, and R. Catchpole. 2001. Safety critical learnings in underbal-
anced well operations. Paper presented at SPE/IADC drilling conference, 27 February–1
March, in Amsterdam, Netherlands.

Johnson, W.G. 1980. MORT safety assurance systems. New York, NY: M. Dekker.
Kvale, S. 2001. Det kvalitative forskningsintervju [The qualitative research interview]. Oslo:

Gyldendal Akademiske.
La Porte, T.R. 1996. High reliability organizations: Unlikely, demanding and at risk. Journal

of Contingencies and Crisis Management 4: 60–71.
La Porte, T.R., and P.M. Consolini. 1991. Working in practice but not in theory: Theoretical

challenges of ‘High Reliability Organizations’. Journal of Public Administration
Research and Theory 1: 19–48.

Latour, B. 1992. Where are the missing masses? The sociology of a few mundane
artifacts. In Shaping technology/building society: Studies in sociotechnical change, ed.
W.E. Bijker and J. Law, 225–64, Cambridge, MA: MIT Press.

Leveson, N. 2004. A new accident model for engineering safer systems. Safety Science 42:
237–70.

Menckel, E. 1993. Evaluating and promoting change in occupational health services. Mod-
els and applications. Sweden: Arbetsmiljöfonden (Swedish Work Environment Fund).

Mitra, N.K., P.K. Dileep, and A. Kumar. 2008. Revival of Mumbai High North – A case
study. Paper presented at SPE Indian Oil and Gas Technical Conference and Exhibition,
March 4–6, Mumbai, India.

Morgan, G. 1998. Images of organization. Thousand Oaks, CA: Sage.
Pasmore, W.A., and M.R. Fagans. 1992. Participation, individual development and organiza-

tional change: A review and synthesis. Journal of Management 18: 375–97.
Patton, M.Q. 2002. Qualitative research & evaluation methods. Thousand Oaks, CA: Sage

Publications.
Pateman, C. 1970. Participation and democratic theory. Cambridge: Cambridge University Press.
Perrow, C. 1984. Normal accidents: Living with high-risk technologies. Princeton, NJ:

Princeton University Press.
Pretty, J.N. 1995. Regenerating agriculture: Policies and practice for sustainability and self-

reliance. London: Earthscan.
PSA, 2011. Risk of collisions with visiting vessels. http://www.ptil.no/news/risk-of-colli-

sions-with-visiting-vessels-article7524-79.html?lang=en_US (accessed January 5, 2012).
Ran, B., P.J. Jin, D. Boyce, T.Z. Qiu, and Y. Cheng. 2012. Perspectives on future transporta-

tion research: Impact of Intelligent Transportation System technologies on next-genera-
tion transportation modeling. Journal of Intelligent Transportation Systems 16: 226–42.

174 T. Kongsvik et al.

Reason, J. 1997. Managing the risks of organizational accidents. Farnham: Ashgate.
Reason, J. 1998. Achieving a safe culture: Theory and practice. Work & Stress 12: 293–306.
Remmen, A., and B. Lorentzen. 2000. Employee participation and cleaner technology:

Learning processes in environmental teams. Journal of Cleaner Production 8: 365–73.
Roberts, K.H. 1990. Some characteristics of one type of high reliability organization. Orga-

nization Science 1, no. 2: 160–76.
Rochlin, G.I. 1999. Safe operation as a social construct. Ergonomics 42: 1549–60.
Rochlin, G.I., T.R. La Porte, and K.H. Roberts. 1987. The self-designing high-reliability

organization: Aircraft carrier flight operations at sea. Naval War College review 40:
76–90.

Rosness, R., T.O. Grøtan, G. Guttormsen, I.A. Herrera, T. Steiro, F. Størseth, R.K. Tinmannsvik,
and I. Wærø. 2010. Organisational accidents and resilient organisations: Six perpectives.
Revision 2. Trondheim: SINTEF Technology and Society.

Rosness, R., S. Hauge, A.B. Skjerve, and K. Aase. 2008. Ti tommeltotter og null ulykker?
Om feiltoleranse. In Robust arbeidspraksis, ed. R.K. Tinmannsvik, 95–104, Trondheim:
Tapir.

Sashkin, M. 1984. Participative management is an ethical imperative. Organizational
Dynamics 12, no. 4: 5–22.

Sklet, S. 2006. Safety barriers: Definition, classification, and performance. Journal of Loss
Prevention in the Process Industries 19, no. 5: 494–506.

Snook, S.A., 2000. Friendly fire: The accidental shootdown of U.S. Black Hawks over
northern Iraq. Princeton, NJ: Princeton University Press.

Suchman, L.A. 1987. Plans and situated actions: The problem of human-machine communi-
cation. Cambridge: Cambridge University Press.

Trist, E. 1981. The evolution of socio-technical systems: A conceptual framework and an
action research program. Paper presented at Conference on Organizational Design and
Performance, April, in Philadelphia, PA.

Vaughan, D. 1996. The challenger launch decision: Risky technology, culture, and deviance
at NASA. Chicago, IL: University of Chicago Press.

Wagner, A.J. 1994. Participation’s effects on performance and satisfaction: A reconsideration
of research evidence. Academy of Management Review 19: 312–30.

Weick, K.E. 1987. Organizational culture as a source of high reliability. California Management
Review 29: 112–27.

Weick, K.E., and K.M. Sutcliffe. 2001. Managing the unexpected: Assuring high perfor-
mance in an age of complexity. San Francisco, CA: Jossey-Bass.

Journal of Risk Research 175

Copyright of Journal of Risk Research is the property of Routledge and its content may not be
copied or emailed to multiple sites or posted to a listserv without the copyright holder’s
express written permission. However, users may print, download, or email articles for
individual use.

Selection of Incident Investigation Methods

Jan Pranger (Krypton Consulting BV)
pranger@kcbv.com

This is an update of the paper that was published in Loss Prevention Bulletin, Issue 209,
October 2009

Summary
This paper identifies the requirements for an incident investigation process. The investigation
process and its investigation methods must (1) provide a chronological and logical event
sequence, (2) identify failed or ineffective barriers and (3) identify root causes that explain the
failure of these barriers. Acceptance of the findings and organisational learning will be helped if
the method is transparent, proportional to the incident type and allows participation. Finally,
methods should be conceptually simple and understandable, comprehensive and should be
recognized by the industry of interest.

A number of tools as described in public sources are described and rated against these
requirements. The paper ends with a comparison of the available methods. It is concluded that
Tripod Beta and a combination of ECFA+/3CA or MORT satisfy these requirements to the
largest extent.

Keywords: Incident investigation; Incident investigation methods, ECFA+; Event sand
Conditional Factors Analysis; Fault tree; Why tree; Barrier analysis; Change analysis; 3CA;
Control Change Cause Analysis; SCAT; Systematic Cause Analysis Technique; MORT;
Management and Oversight Tree; Tripod Beta; Apollo Root Cause Analysis

Investigation Method Requirements

Literature Study
The main tasks of an incident investigation process are defined by Frei et. al. (2003) in a paper
that discussed the different tools that are available for investigation in relationship to the tasks.
These tasks are the following:

Organising facts sequentially
This is necessary to structure the events and circumstantial facts and order them according to
incident chronology and cause and effect relationships. This structure serves as a model for the
incident under study.

Generate hypotheses
Hypothesis generation is necessary to explain uncertainties in the incident model and search for
additional facts.

Identifying norms, novelties and deviations (NND)
The occurrence of an incident may signal the failure of control of a specific activity. This can be
characterized as a deviation from a norm. The applicability of and the deviation from the norm
must be verified and it must be shown that the adherence to the norm would have prevented the
incident. On occasion, the event may be quite novel (i.e. a failure mode that has never been
identified before). In this case, the novel problem must be characterised.

Analysis of Root Causes
Analysis helps to identify why events occurred, aimed at the management level of an
organisation. This is different from the direct causes that immediately preceded the event.

A toolbox for incident investigation should be built so that the complete range of tasks is
covered. Several tools may cover more than one task, however. In addition, the toolbox should

mailto:pranger@kcbv.com

Selection of Incident Investigation Methods

Page 2 of 12

contain tools that complement each other: several methods for one task may be specifically
designed for collaboration with another tool.

A research project in order to identify and explore the relative merits of alternative accident
models and investigation concepts and methods was carried by Ludwig Benner (Benner, 1985)
for the US Government (OSHA). For this report, the most relevant aspect is the identification of
criteria for accident investigation methodologies. The criteria identified in his study can be
summarized as follows:

1. Methodologies should encourage parties to participate in investigations and have their views
heard

2. The methodology should produce blameless output, including the role of management,
supervisors and employees

3. The methodology should support personal initiatives for positive descriptions of accidents
4. It should allow timely discovery of safety and health problems
5. It should increase competence of employees through training in the detection, diagnosis,

control and amelioration of risks.
6. It should provide definitive corrections so that countermeasures can be defined, evaluated

and selected, avoiding personal opinions
7. It should show expectations and behavioural norms that can be enforced
8. It should encourage parties to take their responsibility by providing them with consistent,

reliable accident reports
9. It should be accurate: the accident must be described in a way that it can be “truth-tested”

for completeness, validity, logic and relevance
10. It should be Closed-Loop so that results can be linked routinely to design improvements,

including (pre-incident) safety analyses.

The highest ranked methodologies as identified by Benner reflected applications of risk-oriented
events-process energy-flow accident models with links to work flow design and management
systems. Examples of these methodologies are MORT (Management Oversight and Risk Tree)
and events analysis. Methods as “statistical data gathering” and “completing forms” scored very
low. “Personal/good judgement” scored average on these criteria.

Investigation Qualities were defined by Kingston (2004) as follows:

 Transparency of
o Approach (what is investigated and how)
o Causal factors identified
o Causal factors analysed
o Evidence, and how it resulted in findings and recommendations

 Proportionality
o Investigative effort scaled to occurrence (of incidents)
o Scaling by actual loss, risk and uncertainty

 Accountable, verifiable and open to continuous improvement

Discussion
The requirements for incident investigation that are identified in the previous section refer to the
tasks of an investigation (Frei) and to requirements with respect to the quality of the investigation
process (Benner and Kingston). However, with respect to Frei’s list, we do not regard
“Hypothesis Generation” as a core task, since it is only applicable in cases where relevant
uncertainties are present about the course of events or the causes of these.

For a practical appreciation of the complete investigation process, the criteria of Benner can be
grouped into the following three sets: The methodologies should:

 Encourage participation and learning for all parties involved (1,2,3,5 – refer to Benner’s
criteria above))

 Give clear and practical recommendations (4,6,7,10)
 Provide accurate and consistent reports (8,9)

Selection of Incident Investigation Methods

Page 3 of 12

Only the first criterion applies to the selection of a specific set of tools for incident investigation.
The second and third criteria relate more to the investigation process as a whole. The
“accountable, verifiable and open to continuous improvement” criterion of Kingston is very
closely related to the “transparency” requirement, and in our view essentially identical for the
choice of any method.

The requirements for (a set of) investigation tools can thus be summarized in the following lists.
As core tasks, the investigation toolbox should:

 Provide a chronological and logical event sequence (What happened?)
 Identify ineffective barriers (equivalent to norms, novelties and deviations) (How did it

happen?)
 Identify root causes (Why did it happen?)

These are essential requirements of any investigation. The following requirements deal with the
utilization and acceptance of the method and its results. These are not mandatory, but help to
obtain a valid investigation:

 Transparency is required for acceptance of the method and the results of the investigation
 Proportionality is helpful: it allows that the same method can be used for “small” and “large”

investigations
 Participation of the personnel creates involvement of the organisation and opportunities for

individual and organisational learning

However, in our opinion the following criteria have to be added to the lists above, although they
are again not mandatory:

 The tools should be preferably conceptually simple and easy to understand; the complexity
of a tool should not be a barrier for using it. However, this is only applicable for methods
used for concise and simple investigations. Complex accidents require thorough
investigations and possible complex methods.

 The toolbox should be comprehensive: it should provide a reasonable degree of
completeness and reproducibility

 The tool should be preferably have some degree of recognition in the company or industrial
sector of interest

These criteria will be used to select the methods that will be described in the following sections.

Investigation Methods Description

ECFA+ (Events and Conditional Factors Analysis)

The Events and Conditional Factors Analysis method (ECFA+) was developed by the Noordwijk
Risk Initiative (2007) and produces a sequential description of an incident, which accounts for a
logical relationship from the facts presented. Facts are based on witness narratives and other
evidence. Events and conditions are worded according to simple but strict grammatical rules to
oblige the team of investigators to rigorous thinking. The events, conditions and unknowns are
written on pre-printed and coloured Post-It notes and put on a wall. The notes are connected to
represent causal relationships. A simplified ECFA+ chart looks like this (figures copied from NRI,
2007):

Selection of Incident Investigation Methods

Page 4 of 12

Example of an ECFA+ Chart (Noordwijk Risk Initiative, 2007)

Selection of Incident Investigation Methods

Page 5 of 12

The building blocks are written on the following notes:

Post-It notes used in ECFA+ (Noordwijk Risk Initiative, 2007)

The ECFA+ chart shows the sequence of events and the actors as it can be reconstructed by
the available knowledge. Uncertainties (events, conditions or relations) are identified and can be
further investigated or left as such. Resolution of these may require the formulation and testing
of hypotheses.

Constructing the ECFA+ chart is a group exercise. No special training, other than an explanation
about the method is needed for the participants. The necessary tools are limited to a meeting
room with a “long white wall” and a pack of pre-printed Post-It notes. The ECFA+ method is
available in the public domain.

Once the event sequence of the incident is established, an analysis with other tools is usually
necessary to identify the critical events, causes and formulate recommendations.

ECFA+ has been applied for the Enschedé fireworks disaster in The Netherlands in 2002,
especially for the reconstruction of the operations of the fire brigades. It is also in use at the UK
Health & Safety Executive and the Dutch fire brigade organisation.

Brainstorm Methods
Brainstorming methods include HAZOP and “What-If” studies, which are very well established in
the chemical industry. HAZOP (Hazard and Operability) studies rely on guidewords that focus
the discussion, such as “High Pressure”, “Low Level”, etc. If these guidewords prompt for a
credible scenario, potential causes, consequences and (available or assumed) safeguards are
identified.

“What-If” studies involves the team asking questions about failures of equipment, people etc,
such as “What if the procedure was wrong? What if the steps were performed out of order?”
(CCPS, 2003). These questions can be generic or highly specific in nature.

Fault and Event Trees
The construction of fault trees and event trees can help to formulate hypotheses. A fault tree
(CCPS, 2003) start at the top event (e.g. the incident) and works its way down to the potential
causes using logical AND and OR gates. It helps to structure the facts and to identify any events
that are supposedly necessary to produce the top event. By working down from the top events
and including known facts, the influence of preliminary conclusions about bottom causes is
reduced. If a fault tree is carefully constructed and hypothetical issues are identified as such, it
could be used to establish the event sequence and identify barriers for simple analyses.

Selection of Incident Investigation Methods

Page 6 of 12

An event tree (CCPS, 2003) is an inductive technique that helps in understanding the potential
outcomes of combinations of events. Each event, such as equipment failure, process deviation,
control function, or administrative control, is considered in turn by asking a simple yes/no
question. The tree branches then in a number of parallel paths until all combinations are
exhausted. Paths that lead to the observed consequence can then be further inquired for
validity.

Examples of fault and event trees are shown below:

Example of fault and event trees (CCPS, 2000)

Why Three and Causal Tree Methods
The Why Tree and Causal Tree methods (CCPS, 2003) are variants of the fault tree method. In
the Why Tree, all direct losses and associated consequences are entered into separate boxes.
These are then challenged by asking “why?”, and the answers entered in new boxes and again
challenged by asking the “why” question. The process stops when management system factors
are identified that could have prevented the incident. Recommendations are then developed.
According to the “Baker Report” (Baker 2005), this method (the “Five Why”) “can lead to a very
narrow and superficial incident analysis and may not identify the best corrective actions—
especially if the investigation team is not properly trained.”

In the Causal Tree method, the adverse events are explained in a multidisciplinary group
session by asking the following three questions at each level of the constructed tree:

1. What was the cause of this result?
2. What was directly necessary to cause the end result?
3. Are these factors (from question 2) sufficient to have caused this result?

The team is generally required to identify three root cause factors for the last question, an
organisational, human and material factor. This reflects the notion that most incidents have
multiple root causes.

Barrier Analysis
Barrier Analysis identifies which safety or control functions have failed and allowed the incident
sequence to occur. It is based on the notion that the “Barrier” stands between the “Energy” (any
harmful agent) and the “Target” (anything that should be protected from the Energy). Barriers
may be physical (safety valve, blast wall), temporal or spatial. These barriers, sometimes
requiring acts can have an administrative or cognitive component (procedures, standards,
supervision, knowledge, experience). These components (e.g. procedures) are not barriers itself,
only a good procedure (i.e. aimed at prescribing a barrier) that is properly applied in the situation
it is intended for.

Selection of Incident Investigation Methods

Page 7 of 12

In a Barrier Analysis (NRI, 2009; described in the MORT manual), for each significant episode in
the incident sequence, the Energy Flow and the Target are identified and precisely described.
The Barriers that should be in place are then identified, and verified whether they were available.

Change Analysis
Change Analysis (Johnson, 2003) is used to determine whether abnormal operating practices
contributed to the causes of an adverse occurrence. Change Analysis helps to identify the
differences between what was expected to occur and what actually occurred in performing the
following steps:

1. Define the problem
2. Establish what should have happened
3. Identify, locate and describe the change
4. Specify what was and what was not affected
5. Identify the distinctive features of the change
6. List the possible causes
7. Specify the most likely causes

Practical difficulties of this method arise, however, when it is difficult to establish what should
have happened, or if change is a normal aspect (e.g. in start-up/shutdown and batch
operations). However, the method is claimed to be useful in case of vague, difficult to describe
and to understand failures.

3CA (Control Change Cause Analysis)
3CA (Control Change Cause Analysis) is a combination of barrier analysis, change analysis and
root cause analysis. On basis of the ECFA+ chart, the “risk-increasing” events are selected and
further analyzed, and possible missing or ineffective barriers identified. The upstream reasons
for these ineffective or missing barriers are then further elaborated. For each event, it the
following is determined in a tabular form (NRI 2002a):

1. Change to a person of thing (e.g. the officer walks from verge towards Car 2)
2. Agent of change (what exactly is changing: the officer walks)
3. Adverse effect of change (officer in path of oncoming traffic)
4. Work controls (barriers) implied in (1) and (2) (e.g. segregation from people and traffic)
5. Significance rating for subsequent analysis
6. Describe in what way each measure in (4) was ineffective
7. What upstream processes failed to identify or prevent the problems noted in (6) (e.g.

insufficient training)
8. “Why?” (with respect to all entries in column 7)

3CA identifies thus the failed barriers (steps 0 – 6) and the reasons for this (7 – 8). The “Why”
question identifies Root Causes. The 3CA method is freely available from NRI (2002). It has
been developed by the Noordwijk Risk Initiative as a Root Cause Analysis method for the
Humber Chemical Focus, an UK industrial association.

SCAT (Systematic Cause Analysis Technique)
SCAT (Systematic Cause Analysis Technique) is a commercial and proprietary, checklist-based
tool for incident investigation. It is primary aimed at occupational injury cases, and can thus not
directly be used for other incident types. Event types are linked to a number of immediate
causes, then to basic causes and then to corrective action areas, all of which are pre-defined. It
has thus some built-in “intelligence”. This should make the use of (E-)SCAT fairly straightforward
and easy.

The validity of SCAT is difficult to judge, not the least because there is no public scientific
reference available. We believe that the use of predefined trees invites people to do very
superficial investigations: the tool, and not the investigator, determines the depth and the quality
of the investigation. The investigation can be done on pre-printed forms or with the aid a
computer program (eSCAT®, via www.dnvtraining.com).

Selection of Incident Investigation Methods

Page 8 of 12

MORT (Management Oversight and Risk Tree)
The MORT (Management Oversight and Risk Tree) is a pre-defined logical diagram which ‘asks’
the investigator all kinds of relevant questions about the losses that constitute the top event, that
are key events, as identified in other phases of the investigation of the incident. MORT is
designed to use in concert with a preceding Barrier Analysis (NRI, 2009). Key episodes are for
example:

 A vulnerable target exposed to…..
 An agent of harm in the….
 Absence of adequate barriers

MORT is based on the hypothesis that either a loss is the outcome of a problem in the
organisation, or it is the outcome of an accepted risk. The first step in a MORT analysis consists
of understanding the energy flow and which barriers have failed, and to find whether the loss is
caused by “Oversights and Omissions”. The next decision point separates what happened from
why it happened. The “what happened” branch addresses the barriers/controls that should be in
place, while the “why” considers general management factors. Eventually the tree breaks down
to each of these factors until root causes are reached, which can take up to 13 levels of the tree
and some 1500 different root causes.

If no “Oversights and Omissions are found, the risk is an “Assumed Risk” that must explicitly be
identified, analyzed and accepted by the management. A simplified part of a MORT chart is
shown below (CCPS, 2000):

Simplified MORT chart (“LTA” is Less Than Adequate)

In practice, the MORT chart is traversed for every key episode by noting problems, satisfactory
issues and issues where more information is needed. MORT charts are printed on A0/A1 size.
The chart and the manual are freely available from NRI (2009). The MORT chart should not be
regarded as a checklist. It is rather a functional organisation model that is reviewed in order to
identify areas of concern.

Because of its complexity and need of training and experience for the practitioner, a MORT
analysis is only warranted for profound investigations of complex incidents. However, a simpler
Mini-MORT variation has been developed by the U.S. Department of Energy (1992), with about
50 root causes.

Selection of Incident Investigation Methods

Page 9 of 12

Tripod Beta
The Tripod Beta analysis method can be regarded as a synthesis of a number of the methods
described above, especially fault tree and barrier analysis. Tripod Beta adds a human failure
model to this. Barriers fail due to (generally) human substandard acts (called immediate causes).
These acts are made more probable by an adverse context or precondition. The precondition
explains the person’s mindset and is described as the physical, psychological or organisational
context. An individual’s “proneness” to substandard acts cannot be influenced, but his context or
precondition can, by the organisation. Tripod Beta looks for Underlying Causes at management
level that shape the adverse preconditions involved in the accident.

Tripod Beta has been developed by Shell and the universities of Leiden and Manchester
(Groeneweg, 2002) and is used in a large number of industries.

The incident is modelled with Agent-Event-Object trios. An unwanted event occurs when an
Agent of Change (something able to do change or harm, e.g. energy, toxic, budget cuts) acts on
an object (something being changed or harmed, e.g. person, equipment, reputation). Agents,
events and objects can be conceptual things. Events can be transformed in Hazards or Targets
for the next trio. Existing barriers or barriers that should reasonably be expected to be present
are placed in the trios.

EXPLOSION AND
EQUIPMENT
DAMAGED

RELEASE OF
FLAMMABLE LIQUID

PRESSURIZED
CONTENTS IN

PIPING

LOAD DROPPED
FROM CRANE

PIPE RUPTURED

IGNITION SOURCE
(RUNNING TRUCK)

INSTALLED PIPING

MISSING BARRIER:
DROPPED
OBJECTS

PROTECTION

FAILED BARRIER:
NO HOISTING

OVER IN-SERVICE
EQUIPMENT

FAILED BARRIER:
SHUT DOWN &

DRAIN
INSTALLATION

FAILED BARRIER:
NO IGNITION

SOURCE PRESENT

Hypothetical Tripod Beta Core Diagram

Next, the causal path for each failed or missing barrier is determined:

NO HAZARDS
FROM DROPPED

OBJECTS
ANTICIPATED

DFUnderlying Cause

MISSING BARRIER:
DROPPED
OBJECTS

PROTECTION

FAILED BARRIER:
NO IGNITION

SOURCE PRESENT

TRUCK ENGINE
NOT SWITCHED

OFF

Immediate Cause

TRUCK DRIVER DID
NOT KNOW ABOUT

POTENTIAL
IGNITION HAZARDS

Precondition

PROCEDURES FOR
VEHICLES IN
PLANT NOT

COMMUNICATED

COUnderlying Cause

Causal Path of Failed or Missing Barriers to Underlying Causes

Incident investigation with the Tripod Beta method is supported by software marketed by
TripodSolutions (www.tripodsolutions.com).

http://www.tripodsolutions.com/

Selection of Incident Investigation Methods

Page 10 of 12

Apollo Root Cause Analysis
Apollo Root Cause Analysis (www.apollorca.com) is a logical problem solving technique that
relies on building a fault tree of the incident, and trying to arrive at the root causes by repeatedly
asking the “why” question. We could not find any independent references about this method, and
the Apollo website and the demo version of the software (RealityCharting) gives little information.
However, Apollo RCA is used for incident investigation and problem solving in general in several
large US firms. According to one company, the method is very easy to learn and is used in all
layers of the organisation (including the work floor) to investigate simple and complicated
incidents. It is experienced as very useful and its mass application provides many learning
opportunities for the organisation.

Other Commercial Packages
A number of other integrated commercial packages are on the market, such as TapRoot
(www.TapRoot.com) and REASON (www.rootcause.com). These tools are essentially
combinations of the tools already discussed. They are all software-based and claim to have
some degree of in-built intelligence. From a glance at the demo versions of the software. the
tools are similar in the way that they first help to construct an ECF chart, then look for critical
events and related causes, do (some) logic checking or provide suggestions for immediate and
root causes and generate a report.

Discussion
The various tools that were discussed (except Apollo, TapRoot and REASON, due to lack of
information) are compared according to the requirements discussed in the first section of this
paper. This comparison is qualitative and based on the author’s appreciation of the method’s
principles and face validity. Therefore, this comparison is open to discussion. The three shaded
columns refer to the core tasks of incident; the other columns deal more with the utilization and
the acceptance of the methods and their results.

Comparison of Investigation Tools

Tool “What”

Event
Sequ-
ence

“How”

Barriers
Identi-

fication

“Why”

Root
Causes

Transpa-
rency

Propor-
tional or
scalable

Partici-
pation

Easy to
learn
and

apply

Compre-
hensive-

ness

Recog-
nition
(within

industry)

ECFA+ + – – + + + + + –

HAZOP – + – – + + + ? +

What-If – + – – + + + ? o

Fault Tree – o o – + o + ? o

Event tree – o – – + o + ? –

Why Tree and
Causal Tree – – o – + + + – –

Barrier
Analysis – + – + + o + + –

Change
Analysis – o o – + + + – –

3CA – + + + + + o o –

SCAT – o o – – – + – +

MORT – + + + – – – + +

Tripod Beta + + + o + o – + +

+ Method complies with requirement
– Method does not comply
o Method complies to some extent

http://www.apollorca.com/

TapRooT® Root Cause Analysis

Welcome

Selection of Incident Investigation Methods

Page 11 of 12

? Depends on circumstances or application

Tripod Beta and ECFA+ in combination with 3CA (or MORT) both offer a comprehensive toolkit
for a thorough investigation of incidents. Of these, Tripod Beta is firmly based on a validated
human error model, while 3CA/MORT deal more with organisational structures. These methods
are not simple, however, and require trained and experienced practitioners. They are generally
used for investigation of high-risk incidents.

Some other methods (HAZOP, What-If, Fault and Event Tree) are primarily supporting tools for
e.g. generation and testing of hypotheses.

Selection of Incident Investigation Methods

Page 12 of 12

References
Baker, James A. III (2005), The Report of the BP U.S. Refineries Safety Review Panel, p. 198

Benner, L., Jr. (1985), Rating Accident Models and Investigation Methodologies, Journal of
Safety Research, Vol. 16, pp. 105-126

Benner, L., Jr. (2003), Investigating Incident Methodologies (available at www.iprr.org)

CCPS (Center for Chemical Process Safety) (2003), Guidelines for Investigating Chemical
Process Incidents

Frei, R., et.al. (2003), Investigation Tools in Context, JRC/ESReDA Seminar on “Safety
Investigation of Accidents” (available at www.nri.eu.com)

Groeneweg, J. (2002), Controlling the Controllable: preventing business upsets, 5th ed.

Johnson, C.W. (2003), A Handbook of Incident and Accident Reporting, Glasgow (available at
http://www.dcs.gla.ac.uk/~johnson/book)

Kingston, J. (2004), Incident Investigation, course material for Management of Safety, Health
and Environment, Delft University of Technology

Noordwijk Risk Initiative (2002), 3CA Manual (available at www.nri.eu.com)

Noordwijk Risk Initiative (2007), ECFA+ Manual (available at www.nri.eu.com)

Noordwijk Risk Initiative (2009), MORT User’s Manual (available at www.nri.eu.com)

http://www.iprr.org/

http://www.nri.eu.com/

http://www.dcs.gla.ac.uk/~johnson/book

http://www.nri.eu.com/

http://www.nri.eu.com/

http://www.nri.eu.com/

Copyright of Loss Prevention Bulletin is the property of Institution of Chemical Engineers and its content may

not be copied or emailed to multiple sites or posted to a listserv without the copyright holder’s express written

permission. However, users may print, download, or email articles for individual use.

Barrier Analysis

BARRIER	PURPOSE OF BARRIER	PERFORMANCE OF BARRIER
1. Maintenance procedures	Ensure maintenance requests are submitted and acted on in a timely fashion.	This barrier failed since the valve department supervisor was not trained in maintenance request responsibilities.
2. Job Procedures – Housekeeping	Establish expected levels of safety for all tasks.	This barrier failed because the worker failed to follow the procedures for cleanup of spills.
3. Barricade	Warn other workers of a hazardous situation.	This barrier did not exist – there are no written procedures requiring the use of “wet floor” signs.
4. Communication	Ensure emergency information is shared and acted on.	This barrier did not exist – there are no established procedures for relaying emergency information.

Change Analysis

ACCIDENT SEQUENCE

COMPARISON SEQUENCE

DIFFERENCE

ANALYSIS

1. Sam did not clean up the water.

Sam cleans up the water.

No water on the floor.

No clear requirement for immediate cleanup of spills.

2. Maintenance request to repair valve was not submitted.

Maintenance request submitted as soon as leak is discovered.

No potential for water on the floor.

Valve department supervisor did not submit valve repair request.

3. Mary and Tom both called to say they would be late to work. Neither one saw the other’s message; no one saw Sam’s note; no one cleaned up the spill.

Messages from Mary and Tom are passed to another manager, who takes action. Sam’s message is seen, and spill is cleaned up.

Increased chance that spill is discovered and cleaned up before someone slips and falls.

No one on the morning shift was aware of the spill due to poor communication.

BARRIER ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

BARRIER ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

Barrier Analysis of 2007 Propane Explosion in WV

Alex Bangguraa

Running head: BARRIER ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

[Type here]

Columbia Southern University

Part 1:

Three-column barrier analysis worksheet

Barrier Analysis worksheet
Column 1	Column 2	Column 3
Barriers	Intended function	Performance of the barrier
Failed
Unauthorized opening the liquid withdrawal valve	Only opened when the tank is emptied of liquid	This failed activity caused liquid propane released uncontrollably from the tank.
Inexperience of the junior technician	An experienced technician should be aware of existence and function of the telltale	the inexperienced junior technician obstructed the telltale hole
Failure to follow instructions	The technician failed to follow the instructions at the bleed hole which restricts him not to open the tap if in doubt	This led to excessive volume of propane leaking from the valve
Not used
Missing tank nameplates	It would help in identifying and requesting correction of any deficiencies discovered in the year following the acquisition	The technician did not identify the tank placement as deficient therefore opening it to confirm
Pre-Fill Inspection	Inspect the installation for deficiencies such corrosion, fitness of piping, tank placement and tank labeling	Pre-fill inspection was not done in Little General Store
Did not exist
curricula, practical exercises, or knowledge of evaluation in OSHA & NFPA	Give the technician knowledge on evacuation of the valve and the tank	The tank was evacuated wrongly
Propane emergency trainers	There were no emergency trainers which could provide safety and emergency to the fire in the store	The safety emergency provided by parties failed

Part II:

Potential causal factors as revealed in the analysis

The potential causal factors as per the analysis in the U.S. Chemical Safety Board investigation include the following;

One, the responders of the propane explosion, the two service technicians involved and Little General Store employees failed to evacuate the area of explosion as per the recommendations given in the national emergency propane guidelines (Crawl, Daniel A, 2003). Secondly, there was a defect in the tank holding the liquid which was not discovered during the pre-fill inspection. The defect in the withdrawal valve of the existing tank caused the malfunction thus the explosion in the Little General Store.

Again, the junior service technician working in the store had little experience and lacked formal training with operation of the tank withdrawal valve. The inexperience and minimal supervision given to the technician caused the explosion since he did not recognize the defect at the withdrawal valve. He also failed to read the instructions given.

Another cause is the placement of the propane tank against Little General Store building which gave a direct path for the propane to flow directly into the stores’ interior. OSHA and NFPA is also accused of not including knowledge evaluation, curricula and practical exercises in its propane standards while providing trainings to employees in their institutions (OSHA, 2000). This was a cause of the explosion.

The analysis also states that 911 operators in US lack important information callers and offer life-saving advice which lacks propane emergency guidance that can help in collecting crucial information to be used.

Finally, firefighters in West Virginia have no refresher training since it is not required in the area and the propane safety and emergency training is voluntary making the responders to have few personnel responding to firefighting.

References

Crowl, Daniel A (2003) Understanding Explosions, AIChE/CCPS, New York, NY,

The US Chemical Safety Board (CSB), (2004), Investigation Report, Dust Explosion, West

Pharmaceutical Services, U.S. Chemical Safety and Hazard Investigation Board (CSB),

September 2004.

CSB, (2005) Investigation Report, Combustible Dust Fire and Explosions, CTA Acoustics, Inc,

February 2005

CSB, (2005) Investigation Report. Aluminum Dust Explosion, Hayes Lemmerz International-

Huntington, Inc., September 2005

OSHA, (2000) Technical Information Bulletin, Potential for Natural Gas and Coal Dust

Explosions in Electrical Power Generating Facilities, November 2000

BARRIER

ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

BARRIER ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

Barrier Analysis of Propane explosion at the Little General Store in Ghent, WV

Alex Bangguraa

Running head: BARRIER ANALYSIS OF 2007 PROPANE EXPLOSION IN WV 1

[Type here]

Columbia Southern University

The Barrier Analysis Propane Explosion at the Little General Store in Ghent West

Virginia.

BARRIER	BARRIER IMPORTANCE	BARRIER PERFORMANCE
911 Response	This barrier is expected to give the most obliged push to smother the mischance or keep it from happening	The barrier in light of the fact that the 911 reaction group did not assembled enough data from the guests
Training Procedures	This hindrance was required to guarantee that the worker/expert had enough preparing in playing out its obligations.	The expert did not have enough preparing on dealing with perilous materials and did not understand the imperfection on the withdrawal valve.
Hazard Analysis	This is vital on the grounds that it should give the premise under which the danger could be recognized.	The danger examination group did not find the tank as a component of the risk which turned out to be dangerous after the blast
Work Procedures	The obstruction is required to guarantee that the representatives in this store did took after all the work methodology to maintain a strategic distance from mischances	The representative did not play out his due industriousness in working the framework. Some carelessness added to the mischance
Evacuation Procedures	This is a hindrance that is required to guarantee add up to wellbeing for all people around the range of scene	This fizzled in light of the fact that a portion of the general population stayed in the store who later endured wounds after the blast.

The Factors Revealed in the Analysis

There are numerous causal elements that have added to the propane mishap. These are those variables that could have generally been controlled, they could have decreased the extent of the misfortune or possibly keep the mischance from happening. These components are fundamentally human controlled. These variables include:

1. Failure of 911 to find the peril

The 911 administrators don’t have genuinely necessary direction on the most proficient method to gather data from the guests and pass on the applicable data to the fire responders. As we have seen in this manner, the respondents neglected to question the guests about the episode. This cause the respondent group to react to the crisis however with constrained data. The final product is their inability to recognize the tank as one of the perils.

2. Limited Training for the Fire Fighters

The firefighters ought to have gone to preparing of no less than four hours that is identifying with the risky materials and crisis reaction. The reaction group of Ghent Volunteer Department chief had gone to such preparing in 1998. This implies the reacting group needed aptitudes on the best way to manage the fire accordingly expanding the size of the misfortune.

3. Failure Ferrell Gas Inspection and Audit Program

The Ferrell Gas and the investigation group neglected to recognize the tank as a feature of the danger that could build the greatness of the mischance. This is one of the keys focuses that it could have spared the entire procedure of reaction, departure and illuminating the fire contenders on the most proficient method to address the occurrence. On the off chance that the correct techniques were to be tailed, it would have guaranteed that the misfortune would have been avoided in the early stage.

4. Failure of the Respondents on Evacuation Process

The respondent group did not play out the most critical procedure to guarantee that there was any individual inside the scene of the occurrence. There were many individuals who were harmed in the store who could some way or another be sheltered. The inability to do a full departure, came about to loss of lives that ought not have happened.

5. Failure of Propane Education and Research Council

The chamber did not forbid the fluid propane from one tank to the next. In addition, the methodology of dealing with fluid propane. The time that the specialist attempted to exchange the fluid from one tank to the next, the spillage issue emerged.

The extra causal calculates this case is the disappointment of propane instruction and research committee to forbid exchange of fluid propane crosswise over tanks. The disappointment of this chamber added to event of the occurrence. The underlying endeavor by the specialist reverse discharges and the disaster happened. In the event that there were frameworks set up to restrict such movement, then the occurrence could have been averted.

References

Ferrell gas Partners, L.P., 2006. US SEC Form 10-K – Annual Report Pursuant to Section 13 or

15(d) of the Securities Exchange Act of 1934.

Hildebrand, M.S., and G. G. Noll, 2007. Propane Emergencies,3rd ed., National Propane Gas

Association (NPGA) and Propane Education and Research Council (PERC).

NFPA, 2008c. Standard for Competence of Responders to Hazardous Materials/Weapons of

Mass Destruction Incidents, NFPA 472.

Word related Safety and Health Administration (OSHA), 2007. Capacity and Handling of

Liquefied Petroleum Gasses, 29 CFR 1910.110, OSHA.