SafeGuard Projects
SafeGuard ProjectsCapital Projects
 OSHA 1910.119
OSHA 1910.119Free PSM Resource
Incident Investigation · Worked Example

One Incident.
Four Investigation Methods.

Root cause analysis is only as good as the method behind it. Here we take one real incident, the 2019 hydrogen sulfide release at an Aghorn Operating waterflood station investigated by the U.S. Chemical Safety Board, and work it through four common methods: 5-Whys, fishbone, barrier analysis, and fault tree analysis. You will see what each method finds, what each one misses, and why experienced investigators use more than one.

Step 1 · Establish the Facts

What the CSB Found

Every investigation starts with facts, not conclusions. All facts below come from the CSB's published executive summary (Report No. 2020-01-I-TX, May 2021).

The trigger
On October 26, 2019, an Aghorn employee (Pumper A) responded to a pump oil level alarm at the Foster D waterflood station in Odessa, Texas.
The work
He worked to isolate Pump #1 by closing its discharge valve and partially closing its suction valve. He did not perform lockout/tagout first.
The release
At some point that night the pump turned on automatically, and water containing H2S released from it. After the incident, the CSB found a broken plunger on the pump.
What could not be determined
The CSB could not determine whether the pump failure occurred before Pumper A arrived, or when the pump energized while he was closing valves.
The fatalities
Pumper A was fatally injured by H2S exposure. His spouse later gained access to the station, searched for him, and was also fatally exposed.
Conditions in the pump house
The bay doors were about 60% open. The CSB could not confirm whether the exhaust fans were working. Ventilation did not adequately remove the H2S.
Detection and alarms
Pumper A was not wearing his personal H2S detector. The fixed H2S control panel did not receive signals from its sensors, so neither H2S alarm triggered.
Site security and management
By informal policy, gates stayed unlocked while an employee was on site. Aghorn's written policies consisted of a cell phone policy, an alarm call-out procedure, an H2S pamphlet, and a lockout/tagout procedure written after the incident.

The CSB identified six safety issues. We will use them as the "answer key" to see how well each method finds them:

1 · Nonuse of personal H2S detector 2 · Nonperformance of lockout/tagout 3 · Confinement of H2S inside pump house 4 · Lack of safety management program 5 · Nonfunctioning H2S detection and alarm system 6 · Deficient site security
Illustrative example. The analyses on this page are SafeGuard PSM's educational application of common investigation methods to facts published by the CSB. They are not the CSB's methods or work products, and they add no new findings. For the CSB's conclusions, read the official investigation.
1
Method 1

5-Whys

Ask "why" repeatedly until you reach a cause that management can fix. Simple, fast, and easy to teach, but it follows one path at a time. Because two people died in different ways, this incident needs two chains.

Chain A · Pumper A
Why was Pumper A fatally injured?
He was exposed to H2S released inside the pump house.
Why was H2S released?
Pump #1 turned on automatically, and H2S-containing water released from it (a broken plunger was found afterward).
Why could the pump start while he was working on it?
It had not been locked out and tagged out.
Why wasn't it locked out?
Aghorn had no written lockout/tagout policy or procedure, and no LOTO training or enforcement.
Why was there no LOTO program?
Aghorn lacked a safety management program for identifying and controlling hazards such as H2S and hazardous energy.
Chain B · The spouse
Why was the spouse fatally injured?
She entered the pump house while H2S was present.
Why could she reach the pump house?
The access gates were unlocked.
Why were the gates unlocked?
Aghorn's informal practice was to leave gates unlocked while an employee was working on site.
Why was there no warning before she entered?
The fixed H2S control panel was not receiving sensor signals, so neither alarm triggered.
Why weren't security and alarms managed?
No formal site security program and no maintenance and configuration program for the detection system. Again, a missing safety management program.
What 5-Whys found: lockout/tagout (2), site security (6), the alarm system (5), and the management system gap (4).
What it missed or only touched: the personal H2S detector (1) and the pump house ventilation (3) never came up, because each chain followed one path. A different investigator asking different "whys" could reach different answers. That's the method's biggest weakness.
2
Method 2

Fishbone (Ishikawa) Diagram

Sort possible contributing factors into categories so the team looks in every direction, not just down one path. Categories vary. These six fit an operating facility.

People

  • Personal H2S detector not worn
  • Worked on pump without LOTO

Procedures

  • No written LOTO procedure before the incident
  • No evidence management required personal detectors
  • Alarm call-out procedure only

Equipment

  • Pump #1 started automatically
  • Broken plunger found after the incident
  • Fixed H2S panel not receiving sensor signals
Two fatal H2S exposures in the pump house

Facility Design

  • Enclosed pump house confined H2S
  • Bay doors about 60% open
  • Exhaust fan operation unconfirmed

Site Security

  • Gates left unlocked while employee on site
  • No formal security program

Management System

  • No safety management program
  • No detection system maintenance program
  • No enforcement of PPE or LOTO
What the fishbone found: all six CSB safety issues appear somewhere on the diagram.
Its weakness: it lists factors but does not show how they combine or which ones mattered most. Everything looks equally important. It is a brainstorming tool, best paired with a method that tests cause and effect.
3
Method 3

Barrier Analysis

List every barrier that should have stood between the hazard (H2S in produced water) and the people, then ask how each one performed. It's often pictured as the "Swiss cheese" model: harm happens when the holes in every layer line up.

BarrierIntended functionPerformance on Oct. 26, 2019Basis (CSB)
Pump containmentKeep H2S-bearing water inside the pumpFailedBroken plunger found post-incident. Timing of failure could not be determined.
Lockout/tagoutPrevent the pump from energizing during workNot in placeNo written LOTO policy or procedure. Pump not locked out.
Personal H2S detectorWarn the worker of H2S before exposureNot usedNot worn. No evidence management required it.
Fixed detection and alarmsSound an alarm on H2S releaseFailedControl panel received no sensor signals. Neither alarm triggered.
VentilationDilute and remove released gasInadequateBay doors about 60% open. Fan operation unconfirmed. H2S levels stayed high.
Site securityKeep untrained people out of hazard areasBypassed by practiceGates left unlocked while an employee was on site.
Safety management programMake sure all the barriers above exist and workNot in placeNo formal safety or operating policies beyond a few documents.
What barrier analysis found: all six CSB safety issues, plus the pump containment failure, organized by how protection was supposed to work.
Its strength: it points straight at fixes. Every red or orange row is a barrier to restore. Its weakness: it doesn't explain the sequence of events, or why the barriers were missing in the first place, unless you pair it with a "why" method.
4
Method 4

Fault Tree Analysis (Simplified)

Start with the outcome at the top and work downward with logic gates. An AND gate means all branches had to happen. An OR gate means any one branch was enough. A fault tree is the only one of the four methods that can show where the facts run out.

Fatal H2S exposure in the pump house
AND — all four required
H2S released inside the pump house
OR — CSB could not determine which
Pump failed before Pumper A arrived
Pump energized while he closed valves (no LOTO)
H2S accumulated to dangerous levels
AND
Enclosed building
Ventilation inadequate (doors ~60% open, fans unconfirmed)
No warning before exposure
AND
No personal H2S detector worn
Fixed alarms did not trigger
A person was in the pump house
OR
Pumper A responding to the pump alarm
Spouse entered through unlocked gates
Dashed ovals mark the two possible release paths the CSB could not choose between. A good investigation shows uncertainty instead of guessing.
Breaking any one of the four top branches prevents the outcome. That's why each barrier matters on its own. Note that the unlocked gates only appear on the spouse's path. A fault tree forces you to be precise about which failure affected whom.
What the fault tree found: issues 1, 2, 3, 5, and 6, and it is the only method that clearly showed the unresolved question about when the pump failed.
Its weakness: it models events, not organizations. The missing safety management program (issue 4) sits above the whole tree and doesn't fit neatly inside it. Full quantitative fault trees also take real time and expertise.
Step 3 · Compare

How the Methods Stacked Up

Our assessment of how each worked example above captured the CSB's six safety issues. Results depend on the investigators. These reflect the examples on this page.

CSB safety issue5-WhysFishboneBarrierFault tree
1 · Personal H2S detector–✓✓✓
2 · Lockout/tagout✓✓✓✓
3 · H2S confinement / ventilation–✓✓✓
4 · Safety management program✓✓✓Partial
5 · Detection and alarm system✓✓✓✓
6 · Site security✓✓✓✓
Shows sequence and logicPartial––✓
Shows what is unknown––Partial✓

Use more than one method

No single method caught everything with the full picture. A fishbone or barrier analysis to cast a wide net, plus a 5-Whys or fault tree to test cause and effect, is a strong combination.

Go past the person

"He didn't lock it out" and "he didn't wear his detector" are where weak investigations stop. Every method here, pushed far enough, led to the same place: missing management systems.

Be honest about uncertainty

The CSB stated plainly what it could not determine. Good investigations do the same instead of filling gaps with assumptions.

Need an Incident Investigated Right?

SafeGuard PSM helps facilities investigate incidents and near misses, find management system causes, and build recommendations that actually get closed out.

Talk to Us Read the Aghorn Case Study HAZOP Worked Example All 111 Case Studies
Sources

U.S. Chemical Safety and Hazard Investigation Board, Hydrogen Sulfide Release at Aghorn Operating Waterflood Station, Executive Summary from Final Report, Report No. 2020-01-I-TX, May 2021. Executive summary (PDF) · CSB investigation page
The investigation methods shown (5-Whys, Ishikawa/fishbone diagrams, barrier analysis, and fault tree analysis) are general, widely published techniques. The analyses are SafeGuard PSM's illustrative work based solely on the CSB's published facts.

The SafeGuard Family:   SafeGuard PSM  ·  SafeGuard Projects  ·  OSHA1910119.com