Better Questions

Aug 11

In the first edition I argued that after a serious incident, the instinctive question is the wrong one. This edition delivers better questions and a tool that produces them.

The questions derive from James Reason’s published work, but I am using these questions for a different purpose. This decision tree first classifies the action, so we know what kind of problem to examine. The investigation then moves to the performance-influencing factors that shaped the action and the corrective actions those factors suggest. It is not a culpability labeler or a disciplinary gate.

Here is the decision tree. It forces one specific action at a time and asks three questions in order.

The first page forces the investigation to separate the event into individual actions before any questions are asked. The action is described in neutral, factual language without loading the outcome into the wording. Each person’s decisions are evaluated separately. One event may require several passes.

Page two asks three questions in order:

Q1. Did the person intend to do that specific action? If “no,” this leads to an execution error (slip or lapse). If “yes,” proceed to Q2.

Q2. Was there a known rule, procedure, or familiar practice that applied to the situation as they understood it? If “no,” this leads to a knowledge-based mistake. If “yes,” continue to Q3.

Q3. Was the person aware of the correct rule, and did they intentionally choose not to follow it? If “no,” this leads to a rule-based mistake. If “yes,” further analysis is required to understand an intentional departure.

Most importantly, if any answer is not clear, stop and gather more information. For an ongoing investigation, an unclear answer points the team to the specific activity that needs more evidence.

Applying the decision tree to the BP-Husky Toledo incident

To demonstrate the decision tree, I applied it to information in the CSB’s public report on the fatal September 20, 2022 incident at the BP-Husky Toledo Refinery. I did not conduct an independent investigation. The event facts and quotations come from the report. The human-performance interpretation is mine, and I explain the reasoning behind it.

The wrong question is, “Why would anyone drain naphtha to the ground?” That question assumes the two workers knew the liquid was naphtha and then chose to disregard the hazard. There is a wealth of evidence in the CSB report that everyone involved assumed this was an amine-water mixture.

The better question is, “Why did opening another drain path, the two-inch blind flange, make sense to them at that moment?”

Here is what I gathered from the CSB report:

At approximately 6:17 p.m., four operations personnel were at the Fuel Gas Mix Drum. They opened the designed two-inch path to the Flare Knockout Drum and the designed two-inch drain to the Oily Water Sewer. The shift supervisor told an outside operator to keep draining, avoid splashing, and follow the liquid with water to dilute it and “keep vapors down too.” The shift supervisor also told an outside operator to “get air by” (later explained as having SCBA nearby because of expected H₂S).

The supervisor and other operations personnel believed the material was amine-water, and SCBA became part of the response because of the expected hydrogen sulfide hazard. The shift supervisor had already directed the field to keep draining, avoid splashing, and follow the liquid with water “to keep vapors down too.” Two people then left to respond elsewhere, leaving an outside operator and an operator trainee to finish the job.

At approximately 6:32 p.m., the two workers opened ¾-inch bleeds at the sight-glass piping and differential-pressure transmitter and released liquid to the ground. They used a hose to direct it toward a drain, continuing the same vapor-control technique they had been given. At approximately 6:38 p.m., they removed the blind flange and opened the two-inch maintenance valve. (CSB, pp. 35, 58, 155–156.)

Defined action. At approximately 6:38 p.m., the worker who opened the two-inch maintenance valve intended to create another draining path from the Fuel Gas Mix Drum. The two workers believed the liquid was amine-water and it drained to the ground. They continued to use the water hose to knock vapors down.

The two-inch opening is a separate physical action because the method changed. It is not, however, a disconnected decision. My conclusion is that the two workers understood it as a continuation of the same assignment already underway: lower the level, keep draining, and do it fast, using the same water technique they had been instructed to use. No one specifically directed them to remove the blind, but the CSB’s Executive Summary states they opened the vessel while draining it as fast as they could pursuant to the board operator’s radio direction. The specific path changed; the operational objective, the shared diagnosis that this was amine-water, the pressure to act, and the techniques already authorized for that response did not. (CSB, p. 12.)

Q1. Did the person intend to do that specific action? Yes. Opening the valve was a deliberate physical act. That answer establishes intent to act. It does not establish an intent to release naphtha or create a flammable vapor cloud.

Q2. Was there a known rule, procedure, or familiar practice that applied to the situation as they understood it? My conclusion is no for this specific escalation. The refinery had a general draining procedure that prohibited draining to the ground, but it was not the method being used in this emergency. No written or taught response covered this extreme high level or escalation beyond the designed drain paths when they could not keep up. The worker was extending an active manual-draining response with a method invented in real time. (CSB, pp. 34, 58, 75–76, 123–124.)

Result: Knowledge-Based Mistake. The physical action was intentional. The mistaken plan was formed in an unfamiliar situation without an established response that fit the conditions as the workers understood them. Q3 is not reached. Intentional describes the valve movement; it does not make the action an Intentional Departure.

That classification is the beginning of the analysis. It is important to understand the context of these two workers at the time. It directs attention to the performance-influencing factors that shaped the improvised plan:

No established response or adequate draining capacity. The site had no written or taught method for high level in this drum, and the designed closed-system drain could not keep up with the inflow. The workers had to solve an unfamiliar problem in real time. (CSB, pp. 75–76, 123–124.)
Manual intervention was built into the system. High-level alarms and operator response were used as safeguards, and manual vessel draining was common work. The workers were not inventing the objective of draining; they were inventing the next method. (CSB, pp. 68–75, 95–96, 123.)
The response was already underway and operationally directed. Four operations personnel opened the designed drain paths. The supervisor directed splash and vapor control with water, and the board operator told the field to drain as fast as possible. Extending the drainage could reasonably appear to be a continuation of the accepted response. (CSB, pp. 12, 34, 153–154.)
The group shared the wrong process picture. The supervisor and other operations personnel believed the liquid was amine-water, and field personnel did not know how naphtha had entered the drum. SCBA protected against the hydrogen sulfide hazard they expected, but it removed odor as a diagnostic cue and reduced access to the local horn, clear vision, and easy radio communication. Wearing it also reinforced the amine-water diagnosis. (CSB, pp. 35, 58, 154–156.)
Feedback was misleading and conflicting. Opening the differential-pressure transmitter bleed drove its indicated level to zero, and the control room said the level transmitter might have broken. A minute later, the field reported that the sight glass still showed high level. The workers were making decisions from cues that did not agree. (CSB, pp. 35, 155–156.)
Workload and time pressure were extreme. The control room had been in alarm flood for nearly 12 hours and received more than 3,700 alarms. Multiple furnaces and boilers were smoking, emergency responders had been mobilized, and the refinery upset was cascading around the field response. (CSB, pp. 58, 94–97, 153–155.)
The field team thinned. The response went from four people to an outside operator and a trainee who had stayed over from day shift as the other two left to address another high-level problem. (CSB, pp. 26, 35.)

Under those conditions, the two-inch opening makes sense as a knowledge-based mistake within a continuing response, not as evidence that two workers knowingly chose to drain naphtha. This is the purpose of the tool: classify the action far enough to understand the error mechanism, then move into the factors that shaped performance and the corrective actions those factors suggest. It is not a shortcut to blame or discipline.

Help me test it

This is a working draft. If you run a board, lead a crew, turn wrenches, investigate incidents, or supervise a shift, mark it up. Where did separating the actions while preserving their context change your conclusion? Which performance-influencing factor did I miss? Which question is unclear? The voices I most want to hear are the ones closest to the equipment.

Both pages of the tool are in this edition at full page size. The decision tree is also attached as a free document in the LinkedIn post. Want the editable PowerPoint version? The decision tree is attached as a document so you can use it right away.

Want the editable PowerPoint version of the decision tree? Comment “PPT” below and I’ll send you the link to get it.

This is a public working draft. Mark up a working copy and tell me where it breaks.

The tree stops at classification. The investigation does not. Classification tells us where to look; performance-influencing factors tell us what must change. Turning that analysis into durable fixes is the subject of the forthcoming book Process Safety Excellence.

This edition gave you better questions and a tool to classify the action.

The next edition will look at what comes after the classification: how to turn those better questions into better answers and stronger fixes, without just generating more action items that never close.

Better Questions

Better Answers

The Wrong Question