INCIDENT INVESTIGATION BASED ON CAUSALITY NETWORKS

Transcription

1 IChemE SYMPOSIUM SERIES NO. 153 INCIDENT INVESTIGATION BASED ON CAUSALITY NETWORKS Yukiyasu Shimada 1, Rafael Batres 2, Tetsuo Fuchino 3 and Toshinori Kawabata 1 1 Chemical Safety Research Group, National Institute of Occupational Safety and Health, 1-4-6, Umezono, Kiyose, Tokyo , Japan; Tel.: þ , Fax: þ , shimada@s.jniosh.go.jp 2 Department of Production Systems Engineering, Toyohashi University of Technology, 1-1, Hibarigaoka, Tempakucho, Toyohashi, Aichi , Japan; Tel.: þ , Fax: þ , rbp@pse.tut.ac.jp 3 Department of Chemical Engineering, Tokyo Institute of Technology, , Oookayama, Meguro-ku, Tokyo , Japan; Tel.: þ , Fax: þ , fuchino@chemeng.titech.ac.jp The most significant role that incident investigation can play is to prevent disasters by learning from accidents, near misses, and the like. This paper presents a method to guide the construction of possible incident scenarios by facilitating the identification of missing information. This method is based on the concept of causality networks which are representations of causality (the path between the root cause and the final consequences) using a shared and common understanding that can be communicated between members of the team and implemented in computational knowledge bases. Causality networks can be built graphically and then converted to a formal representation that can be used directly in a number of inference software packages that in many cases are freely available. The graphical representation enables visualization and analysis. The formal representation facilitates not only information searching (in the database sense) but also new knowledge extraction which is possible thanks to the logic algorithms that are implemented in the software. KEYWORDS: incident investigation, causality network, plant abnormal scenario, process safety management INTRODUCTION The most significant role that incident investigation can play is to prevent disasters by learning from accidents, near misses, and the like. There is an enormous amount of information available on past accidents in the form of incident reports available as documents and managed by database. Engineers who perform safety analysis can benefit from this information. However, accidents similar to those that occurred in the past painstakingly continue to happen. Current practices in incident investigation are dependent on the investigator s personal background and training. Loosely speaking, there could be cases in which the number of identified causes matches the number of investigators. Furthermore, there is a need that all the members of an operating investigation team share a common language that supports their investigations objectives efficiently and accurately [1]. Causal analysis techniques such as causal factor charts provide a graphical means of representing the sequence of events leading to hazards. However, such diagrams can bias investigators towards the representation of observable events rather than the contributing factors that made those events more likely. We have proposed a method to guide the construction of possible scenarios by facilitating the identification of possible missing information [5]. This method is based on the concept of causality networks which are representations of causality (the path between the root cause and the final consequences) using a shared and common understanding that can be communicated between members of the team and implemented in computational knowledge bases. Finally an example based on an explosion of an isomerization unit illustrates the scenario representation method. EXISTING CAUSAL ANALYSIS TECHNIQUES The main role of an incident investigation is to identify and address all of the causes of an incident from the initiating events to the final consequences based on the evidences gathered at the accident site and interviews. This task involves the construction of possible cause-and-effect relationships which can be represented using some of the techniques outlined below. TIMELINE A timeline is a method for mapping and tracking the chronological chain of the various occurrences in an incident. CCPS notes that two types of occurrences can be distinguished: those that are passive items, such as the pump was running, the pipe was corroded, and those that are active, such as the pump started up or the pipe failed. CAUSAL FACTOR CHART A causal factor chart is a graphical display of the chronology of the incident and it is used to represent the possible sequence of occurrences. A causal factor chart distinguishes between passive and active items. The active items are enclosed in rectangles, and the passive items in ovals. Active items describe an action and must be described with one noun or verb. Each active item should be derived from 1

2 IChemE SYMPOSIUM SERIES NO. 153 the one preceding it. Passive items describe states or circumstances rather than occurrences. Although the distinction between active and passive occurrences is a clear benefit of this technique, the technique is ambiguous in regards to the difference between passive items representing temporal bounding events (such as valve was closed) and participating entities (such as fog in the area). CAUSALITY Incident information encompasses two kinds of information, namely chronological ordering of occurrences and causation information. Causation implies the act of an agent that produces a change of state. Consequently, scenario representation methods should distinguish between both kinds of information. From an analysis of incident reports it can be observed that some causes or effects have a temporal dimension. For example, explosions, runaway reactions, mixing operations, each has a beginning and an ending. Beginnings and endings are entities with zero extent in time. However, current methods cannot distinguish between zero-extent time entities (events) and entities with temporal dimensions (activities). Shoham lists properties of causation some of which are listed here [4]: 1. Causation is antisymmetric. A cannot cause B if B is the cause of A 2. Causation is antireflexive. A cannot cause itself. 3. Causes cannot succeed their effects in time. A(s) causes A(t) ) s t 4. Entities participating in the causal relation have a temporal dimension. For example, explosions, runaway reactions, mixing operations, all have a beginning and an ending. Domotor adds the property of transitivity [2]: If A causes B and B is the cause of C, then A is also the cause of C. CAUSALITY NETWORKS In order to create and visualize causality information, we have introduced the concept of causality network which are based on the ISO standard that defines a format for the representation of knowledge about process plants [5]. ISO Part 2 (standardized as ISO :2003) specifies an lingua franca for long-term data integration, access and exchange. It was developed in ISO TC184/ SC4-Industrial Data by the EPISTLE consortium ( ) and designed to support the evolution of data through time. The core of the standard defines 200 concepts including a meta-model for extending the definitions through what is known as a Reference Data Library (about 20,000 concepts from the engineering domain) [3]. The standard includes the definition of kinds and structures of objects, properties, events, processes and relations which can be used in the integration of material property data, equipment information, maintenance activities, etc. Furthermore, not only does ISO record the process plant as it exists at an instant but also it does record how the plant changes as a result of normal (e.g. maintenance) or abnormal activities. This is critical during the analysis of contributing causes. Causality information contained in the accident report is represented by means of causality networks that are composed of activities and events. A causality network is composed of the following elements: 1. Activities are enclosed by rectangles. Activities involving changes of process variables are complemented with the letter P at the lower right corner of the rectangle. Activities representing operations and control activities include the letter O at the lower right corner of the rectangle 2. Events are shown by ovals 3. Participating entities are enclosed by hexagons 4. Causal relations are represented as solid arrows identified by the word cause of event. A cause of event Figure 1. Symbols used in a causality network 2

3 IChemE SYMPOSIUM SERIES NO. 153 Figure 2. BP incident scenario (Diagram 1) Figure 3. BP incident scenario (Diagram 2) 3

4 IChemE SYMPOSIUM SERIES NO. 153 Figure 4. BP incident scenario (Diagram 3) indicates that the caused (event) is caused by the causer (activity) 5. Temporal relations (beginning and ending) are represented as solid line with a filled circle identified by either the words beginning or ending. A beginning relation marks the temporal start of an activity or physical objects. An ending relation marks the end of a possible individual. 6. The participation relation is represented as a solid line with an empty circle identified by the word participation. A participation relation is a part-whole relation that indicates that physical objects are resources, instruments, or performers of an activity 7. Chronological information from the timeline can be added next to the activities or events. EXAMPLE During the start-up of Isomerization Unit on March 23, 2005, explosions and fires occurred, incurring in fifteen fatalities and harming over 170 persons in the Texas City Refinery, operated by BP Products North America Inc. [6]. On May 2005, an interim report was released and presented an analysis of the events leading up to the incident. The report identified a number of initiating events and enabling conditions, and made a number of early recommendations to prevent the recurrence of a similar incident. In this interim report, the development to the explosion and fire could be analyzed in detail and documented. A chronology of the events leading up to the incident is summarized and some candidates of root cause and accident scenarios are identified. 4

5 IChemE SYMPOSIUM SERIES NO. 153 Figure 5. BP incident scenario (Diagram 4) which explains the increase of pressure. The pressure is released manually by operator intervention. In Diagram 4, it can be seen how the decrease of pressure causes the creation of nucleation sites. The heat from the burners causes the pressure in nucleated sites to increase. Incidentally, the momentary decrease of pressure causes vapor in nucleated sites to expands which results in release of liquid from column overhead relief valves which can be associated with the fatal consequences of the accident. Based on preliminary opinions by two incident investigators, causality networks present the following advantages compared to other representation methods: CAUSALITY NETWORK FOR BP INCIDENT SCENARIO Causality networks are used to represent the BP incident scenario based on the interim report. Figures 2 5 shows them. Diagram 1 shows an initial accumulation of liquid hydrocarbon in the column. The feed was charged to the stripper unit and the feed was closed. Two kinds of activities can be distinguished; activities representing process behavior such as Level increasing and activities representing control or operation actions such as Closing feed valve. In diagram 2, the feed is reintroduced and the level reaches a head of 137 ft of hydrocarbon. Liquid level stops to increase when heavy raffinate leaves from the bottoms of the stripper. The reboilers are lit (Diagram 4), heating the bottoms of the column. As heavy raffinate leaves through the bottoms pipeline, it preheats the feed which contributes to the accumulation of heat in the column. The heat and pressure effects are shown in Diagram3. The heat from burners causes vapor inventory to increase Graphical representation is easy to understand. The distinction between activities, events and participating entities allows a more unambiguous description of the causation, temporal information, and the substances, equipment, personnel involved in the occurrences.

6 IChemE SYMPOSIUM SERIES NO Because the causality network is based on ISO 15926, instances in the graph can be integrated with plant databases such as those containing equipment data. maintenance activities and preventing the occurrence of similar incidents. CONCLUSION This paper introduced a knowledge-based approach for representing accident information which examined the concept of causality networks as a model to integrated causality information with objects involved in the accident. And it applied to example incident scenario to evaluate the proposed method that describes the scenario causality and participating physical objects. Still, many improvements are necessary. For example, some features that already exist in causal factor charts are missing, such as the distinction between presumptive and factual data. As future work, ultimate goal is to develop the system which can support engineering activity or safety operation, etc. based on lesson learned from past incident. It is planned to integrate some of the classes in the accident database with the ontology. Thus, the result of search of information on past incident case example makes it possible to reuse for supporting safety design, safety operation and REFERENCES 1. Center for Chemical Process Safety, 2003, Guidelines for investigating chemical incidents, 2 nd Ed., Wiley AIChE. 2. Findler, N.V. and Bickmore, T., 1996, On the Concept of Causality and A Causal modeling system for scientific and engineering domains, CAMUS, Applied Artificial Intelligence, 10: Leal, D., 2005, ISO Life Cycle Data for Process Plant: An overview, oil & gas science and technology Rev IFP, 16: Shoham, Y., 1988, Reasoning about Change, MIT Press, Cambridge, Massachusetts. 5. Suzuki, M., Batres, R., Fuchino, T., Shimada, Y. and Chung, P. W., 2006, A Knowledge-based approach for accident information retrieval, Proc. of ESCAPE-16 & PSE2006: The US Chemical Safety Board, 2005, Fatal accident investigation report - Isomerization unit explosion, Final report, Texas City, Texas. 6