Incident Investigation and Fire Safety Analytics

Introduction

Industrial fires and explosions rarely result from a single isolated mistake. They usually emerge from a combination of hazardous conditions, failed safeguards, inadequate decisions, ineffective supervision, and organisational weaknesses. Incident investigation is therefore more than identifying the person who operated equipment at the time of an event. Its purpose is to establish what happened, why it happened, how the consequences developed, and what controls must change to prevent recurrence.

In fire and safety practice, investigation has two complementary dimensions. Forensic investigation reconstructs the event and determines the origin and cause. Safety investigation examines the performance of barriers, procedures, management systems, competence, maintenance, and organisational learning. A technically correct conclusion about ignition is incomplete if it does not explain why flammable material accumulated, why detection failed, or why emergency response was delayed.

Fire safety analytics extends investigation from individual events to patterns across time. It combines incident records, near-miss reports, inspection findings, maintenance data, permit-to-work records, training information, alarm histories, and process data. Properly used, analytics identifies weak signals before they develop into major fires or explosions.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Secure an incident scene and preserve physical, documentary, witness, and digital evidence.
2. Distinguish fire origin, ignition source, immediate cause, contributing factors, and root causes.
3. Construct an incident timeline from reliable evidence and identify uncertainty.
4. Apply the five-whys method, fault-tree analysis, and root-cause analysis appropriately.
5. Calculate and interpret selected leading and lagging fire-safety indicators.
6. Evaluate corrective actions using the hierarchy of controls and barrier-management principles.
7. Recognise ethical, legal, privacy, and governance requirements in investigation.

1. The Investigation Problem: What Must Be Established?

A sound investigation answers several different questions. Confusing them produces weak conclusions.

Origin and cause

The origin is the location or region where the fire or explosion first developed. The cause is the set of circumstances that initiated and sustained the event. Cause should be expressed at appropriate levels:

• Direct cause: the physical event immediately producing ignition or release.
• Contributing factor: a condition that increased the likelihood or severity of the event.
• Underlying cause: a weakness in a process, barrier, design, or management system.
• Root cause: a fundamental organisational or system condition whose correction would substantially reduce recurrence risk.

The term “root cause” should not imply that every event has one unique cause. Complex incidents commonly have several interacting causal pathways. A good report distinguishes established facts from hypotheses and unresolved questions.

2. Investigation Governance and Scene Preservation

Initial priorities

The first priority is life safety. Rescue, firefighting, isolation of energy, evacuation, and prevention of secondary explosions take precedence over evidence collection. Once the scene is safe, the incident commander or authorised investigator should establish control of the area.

Important early actions include:

1. Establish exclusion zones and control entry.
2. Record the condition of the scene before disturbance, where safe.
3. Isolate electrical, mechanical, hydraulic, pneumatic, thermal, and chemical hazards.
4. Prevent cleaning, repair, movement, or disposal of equipment without authorisation.
5. Identify perishable evidence, including volatile residues, weather conditions, alarm data, and temporary equipment states.
6. Notify regulatory, emergency, insurance, and law-enforcement bodies where required.
7. Create an evidence register and maintain chain of custody.

Evidence categories

Chain of custody

Chain of custody demonstrates who collected, transferred, stored, examined, and released an item. Each item should have a unique identifier, description, collection location, date and time, collector, packaging method, seal condition, storage location, and transfer record. Digital evidence requires special care: copying a file can alter metadata, while opening proprietary files may change access logs. A forensic image, cryptographic hash, or controlled read-only export may be appropriate under organisational or legal procedures.

Documentation methods

Investigators should combine photographs, sketches, measurements, video, samples, and written observations. Photographs should include overall views, intermediate views, and close-ups with scales. The investigator should record negative evidence—for example, an alarm that did not activate or an expected burn pattern that is absent. Absence of evidence is not automatically evidence of absence, because fire suppression, ventilation, collapse, and post-fire disturbance may destroy indicators.

3. Witness and Digital Data Collection

Witness interviews

Witnesses should be interviewed individually in a quiet setting. The interviewer should begin with open questions such as “Tell me what you observed from the beginning,” then clarify time, location, sound, smell, movement, alarms, actions, and uncertainty. Witnesses should not be shown other statements before giving their own account. Investigators should distinguish:

• direct observation from interpretation;
• memory from information learned later;
• exact time from estimated time;
• certainty from speculation.

A witness account is evidence, not automatically fact. Human memory can be affected by stress, smoke, noise, injury, group discussion, and hindsight. Contradictions should be documented and tested against independent evidence rather than concealed.

Digital evidence

Modern plants produce extensive operational data. Potential sources include distributed control systems, programmable logic controllers, safety instrumented systems, fire and gas panels, access-control systems, radio recordings, CCTV, vehicle tracking, mobile devices, electronic permits, maintenance-management systems, and laboratory results.

Digital analysis must address time synchronisation. A control system, CCTV recorder, and mobile telephone may each display a different time. Investigators should identify time zones, daylight-saving settings, clock drift, network time sources, and whether timestamps represent event time, recording time, or display time. A timeline should state the reference time used and any correction applied.

Data should be preserved before routine overwrite occurs. Investigators should record the system owner, extraction method, file format, software version, export settings, and integrity check. Data privacy must be respected; only information relevant to the investigation should be collected and access should be restricted.

4. Reconstructing the Event

Timeline construction

A timeline converts scattered evidence into an ordered sequence. It should include normal operation before the event, initiating deviations, alarm and control-system responses, human actions, escalation, emergency response, and recovery.

A practical timeline table contains:

Reliability is not the same as importance. A witness may provide the only information about an unrecorded action, while a sensor may have high precision but questionable calibration. Investigators should identify gaps rather than filling them with assumptions.

Barrier analysis

A barrier is a measure intended to prevent an initiating event, detect it, control escalation, protect people, or limit consequences. Barriers may be physical, technical, procedural, or organisational. Examples include containment, ventilation, gas detection, automatic isolation, firewater, explosion relief, permit controls, competency, and emergency planning.

For each barrier, ask:

1. What was the barrier intended to do?
2. Was it present and correctly designed?
3. Was it available at the time?
4. Did it activate when required?
5. Was its performance adequate?
6. What management system ensured inspection, testing, and maintenance?

A barrier can fail because it is absent, bypassed, degraded, wrongly selected, defeated by the event, or activated too late. Barrier analysis helps avoid explanations that focus only on the last failed component.

5. Causal Analysis Methods

The five-whys method

The five-whys method repeatedly asks why a condition occurred until the analysis reaches controllable system conditions. “Five” is not a mandatory number. The process should stop when further questioning becomes speculative or when a cause is outside the investigation’s control and must be addressed through another risk owner.

Example:

• Fire occurred at a solvent transfer pump.
• Why? Solvent leaked onto a hot motor surface.
• Why? The mechanical seal failed.
• Why? The seal was incompatible with operating temperature and solvent properties.
• Why? The equipment specification did not reflect the revised process conditions.
• Why? Management of change did not require technical review of seal materials.

This chain is useful but simplified. A complete analysis should also examine why detection, isolation, ventilation, and emergency response did not prevent escalation. Five-whys is weak when used as a single linear chain for a complex event.

Fault-tree analysis

Fault-tree analysis (FTA) is a deductive method. It begins with a top event, such as “major fire in solvent area,” and works backward through combinations of failures. An OR gate means any input can produce the output; an AND gate means all required inputs must occur.

For example, a fire may require:

• flammable vapour present; AND
• an effective ignition source present.

Flammable vapour may result from a release OR inadequate ventilation. Ignition may result from a hot surface OR electrical spark OR static discharge. The tree exposes alternative pathways and supports barrier review.

If independent basic-event probabilities are known, an OR relationship for two events can be estimated as:

For statistically independent events, P(A ∩ B) = P(A)P(B), so:

Here, P denotes probability and A and B are events. Independence must not be assumed merely for convenience; common maintenance, environmental, or design causes can make failures dependent. In many diploma-level investigations, FTA is used qualitatively because reliable failure probabilities are unavailable.

Root-cause analysis

Root-cause analysis (RCA) is a disciplined process for identifying physical, human, organisational, and external causes and selecting corrective actions. A useful RCA classification is:

• Physical causes: failed seal, blocked detector, damaged cable, inadequate fire resistance.
• Human-performance causes: misunderstanding, workload, communication failure, skill deficiency.
• Organisational causes: inadequate design review, poor maintenance strategy, ineffective change management, production pressure, weak supervision.
• External causes: weather, utility interruption, supplier defect, third-party activity, regulatory or market conditions.

RCA should be evidence-based, proportional to potential severity, and independent where conflicts of interest exist. It should not become a search for blame. Blame may be appropriate for deliberate misconduct, but ordinary error often indicates that system design and controls were insufficiently tolerant of human limitations.

6. Quantitative Fire-Safety Analytics

Lagging and leading indicators

Lagging indicators measure outcomes after harm or loss has occurred. Examples include fires, explosions, injuries, property damage, process shutdowns, reportable releases, and emergency-response time.

Leading indicators measure preventive activity or the condition of controls. Examples include overdue fire-protection tests, percentage of safety-critical equipment available, closure time for high-risk findings, quality of permit audits, detector impairment duration, completion of competency assessments, and near-miss reporting.

Neither category is sufficient alone. A site may report zero fires because controls are effective—or because near misses are suppressed. Conversely, increased near-miss reporting may indicate deteriorating conditions or improved reporting culture. Indicators require interpretation and context.

Basic rates

A frequency rate normalises events against exposure. A commonly used occupational formula is:

Here, K is a chosen constant, such as 200,000 or 1,000,000 hours, defined by the organisation or regulator. The chosen constant and incident definition must be stated; rates using different conventions must not be compared directly.

For example, if a site records 3 recordable incidents in 600,000 hours and uses K = 200,000:

A process-safety event rate may instead use process hours, production quantity, or facility exposure. Denominators must represent meaningful exposure and should not hide changes in staffing, operating hours, or production complexity.

Control-performance indicators

A useful leading indicator is the percentage of planned safety-critical tests completed on time:

If 184 of 200 due tests were completed on time:

The measure does not demonstrate that tests were technically adequate. A high percentage with poor test quality can create false assurance. Indicators should therefore include quality sampling, overdue duration, repeat defects, and impaired protection.

Trend interpretation

Analysts should examine counts, rates, severity, recurrence, location, shift, equipment type, and exposure. Small numbers fluctuate substantially, so a single-month increase may not establish a trend. Control charts or moving averages can support interpretation, but statistical methods must account for changing exposure and reporting behaviour. Correlation does not establish causation: more inspections may correlate with more findings because inspections reveal problems rather than create them.

7. From Findings to Effective Corrective Action

A corrective action should address a verified causal mechanism, have an owner and due date, and include a method for verifying effectiveness. “Retrain staff” is often insufficient when the underlying problem is poor design, ambiguous procedures, inaccessible isolation points, or excessive workload.

The hierarchy of controls gives preference to stronger measures:

1. Elimination of the hazardous operation or material.
2. Substitution with a less hazardous material or process.
3. Engineering controls such as containment, ventilation, interlocks, detection, isolation, and explosion protection.
4. Administrative controls such as procedures, permits, scheduling, supervision, and training.
5. Personal protective equipment, which is important but generally the least reliable as the primary prevention measure.

Actions should be prioritised according to risk, urgency, feasibility, and barrier importance. Temporary compensating measures should be documented and removed when permanent controls are restored. Effectiveness review should ask whether exposure, failure probability, or consequence has actually been reduced, not merely whether an action was closed in a database.

8. Illustrative Case: Solvent Transfer Fire

Background

This fictional case concerns a solvent blending facility. A transfer pump supplied a mixing vessel through a flexible hose. The area had local ventilation, fixed fire detection, portable extinguishers, and an emergency shutdown system.

Problem

During a night shift, a flash fire occurred near the transfer pump. One operator suffered minor burns, and production stopped for two days. Initial discussion suggested operator error because a transfer valve had been left open.

Analysis

Scene examination showed solvent deposits around the pump and heat damage concentrated near the motor. The mechanical seal had failed. The process historian showed a gradual rise in pump discharge temperature, but the alarm had been inhibited during earlier maintenance and had not been restored. CCTV showed that the operator discovered the leak approximately two minutes before ignition. The emergency shutdown button was located outside the immediate access route and was not activated before ignition.

Document review found that the solvent formulation had changed three months earlier. The change-management record covered production quality but did not require review of seal compatibility, alarm settings, or ventilation demand. Maintenance records showed repeated minor seal leakage, but the trend had not been escalated. The operator had followed the written transfer procedure, which contained no instruction for responding to early seal leakage.

Causal model

The immediate cause was ignition of solvent vapour at or near a hot pump motor surface. Contributing factors included seal deterioration, inadequate response to leakage, inhibited temperature alarm, and delayed isolation. Underlying causes included incomplete management of change, weak defect escalation, and insufficient consideration of accessible emergency controls.

The investigation did not conclude that the operator caused the fire. The operator’s action was one element in a system whose barriers were poorly designed and maintained.

Approach and solution

The facility implemented the following actions:

• replaced the seal with a material verified for the revised solvent and temperature range;
• installed a compatible double-seal arrangement with leakage detection;
• redesigned the alarm-inhibition process to require authorisation, time limits, and independent restoration checks;
• relocated or duplicated emergency isolation controls;
• revised the management-of-change checklist to include fire, explosion, alarm, ventilation, and materials-compatibility review;
• introduced a leading indicator for safety-critical alarm impairments;
• reviewed all similar pumps and analysed recurring seal defects;
• trained personnel in early leak recognition and emergency isolation without relying on training as the sole control.

Outcome and learning points

A follow-up audit verified the hardware changes, tested alarm restoration, and sampled operator responses. The principal learning point was that the visible valve position and operator action were not the complete cause. The event developed through interaction among process change, equipment compatibility, maintenance history, alarm impairment, and emergency-access design. Effective prevention required several coordinated barriers rather than a disciplinary response.

9. Ethical, Legal, and Professional Considerations

Investigators owe duties to truth, safety, affected persons, and due process. Reports should be accurate, impartial, traceable, and understandable to decision-makers. Evidence should not be altered to support a preferred conclusion. Confidential information must be protected, and personal data should be collected only for legitimate purposes.

Where a fatality, serious injury, major fire, explosion, environmental release, or suspected criminal act occurs, internal investigation must not obstruct statutory investigation. Organisations should obtain appropriate legal and technical advice concerning notification, privilege, evidence retention, worker representation, and publication.

The “just culture” principle distinguishes human error, at-risk behaviour, and reckless or intentional violation. This approach supports learning while retaining accountability. Investigators should also consider language, fatigue, disability, contractor status, cultural factors, and power relationships when evaluating human performance.

10. Contemporary Tools and Limitations

Geographic information systems, digital twins, automated alarm analytics, drone imagery, 3D scene mapping, machine learning, and natural-language processing can improve investigation and prevention. For example, algorithms may detect repeated detector impairments or classify recurring maintenance defects.

However, technology does not replace professional judgement. Artificial intelligence may reproduce biased historical reporting, confuse correlation with causation, or produce confident explanations unsupported by evidence. Models should be validated, their training data and assumptions documented, and important decisions reviewed by competent personnel. Automated systems should support—not conceal—uncertainty.

Common investigation limitations include scene disturbance, missing records, unreliable clocks, incomplete witness recall, survivorship bias, low-frequency events, changing plant configuration, and pressure to reach a rapid conclusion. A strong report identifies these limitations explicitly and distinguishes confirmed, probable, possible, and unknown findings.

Best-Practice Investigation Workflow

A practical workflow is:

1. Protect people and stabilise hazards.
2. Notify required authorities and appoint competent investigators.
3. Secure the scene and preserve perishable evidence.
4. Define scope, questions, evidence sources, and independence requirements.
5. Collect physical, documentary, human, digital, and environmental evidence.
6. Establish a synchronised timeline.
7. Determine origin and immediate cause.
8. Analyse barriers, contributing factors, and systemic causes.
9. Test alternative explanations and identify uncertainty.
10. Develop proportionate corrective actions using the hierarchy of controls.
11. Assign owners, deadlines, and effectiveness measures.
12. Share lessons across similar operations and verify sustained improvement.

Chapter Summary

Incident investigation is a structured process for learning from fires, explosions, releases, near misses, and degraded safeguards. Life safety and scene stabilisation come before evidence preservation. Reliable investigation integrates physical, documentary, witness, digital, and environmental evidence while maintaining chain of custody and recording uncertainty.

Origin identifies where an event began; cause explains the physical and organisational conditions that produced it. Timelines reconstruct sequence, barrier analysis examines failed or missing protections, five-whys explores causal depth, fault trees identify alternative pathways, and root-cause analysis connects physical events to human and organisational systems.

Lagging indicators measure outcomes, whereas leading indicators measure the condition and performance of preventive controls. Rates are meaningful only when definitions, denominators, constants, and exposure are transparent. Corrective actions should favour elimination and engineering controls, include accountable ownership, and be verified for effectiveness. Ethical investigation is impartial, evidence-based, privacy-conscious, legally compliant, and focused on learning without confusing ordinary human error with wilful misconduct.

Key Terms

Origin: The location or region where a fire or explosion first developed.

Cause: The circumstances and mechanisms that initiated and sustained an incident.

Direct cause: The immediate physical event producing ignition, release, or harm.

Contributing factor: A condition that increases the likelihood or severity of an event.

Underlying cause: A weakness in a process, barrier, design, or management system.

Root cause: A fundamental system condition whose correction reduces recurrence risk.

Chain of custody: Documented control and transfer history of evidence.

Physical evidence: Material objects, components, residues, and damage patterns relevant to an investigation.

Digital evidence: Electronically stored information such as alarms, CCTV, historian data, and access records.

Timeline: An ordered reconstruction of events using evidence and stated uncertainty.

Barrier: A measure intended to prevent, detect, control, or mitigate an incident.

Five-whys: An iterative questioning method for exploring causal depth.

Fault-tree analysis: A deductive method that models pathways to a defined top event.

Root-cause analysis: A systematic method for identifying physical, human, and organisational causes.

Leading indicator: A measure of preventive activity or control condition.

Lagging indicator: A measure of harm, loss, or other outcome after an event.

Exposure denominator: The quantity, time, or activity used to normalise an incident rate.

Management of change: A controlled process for assessing risks created by modifications.

Just culture: An approach that promotes learning while distinguishing error from reckless or intentional conduct.

Effectiveness verification: Evidence that a corrective action has reduced risk or improved control performance.

Review Questions

5 Short Answer Questions

1. Distinguish between fire origin and fire cause.
2. What information should be recorded in a chain-of-custody log?
3. Differentiate a leading indicator from a lagging indicator.
4. Why must digital-system clocks be checked during timeline construction?
5. State two limitations of the five-whys method.

5 Long Answer Questions

1. Explain the principal stages of an industrial fire investigation from scene stabilisation to corrective-action verification.
2. Discuss how witness evidence and digital evidence should be collected, assessed, and preserved.
3. Explain barrier analysis and show how it differs from identifying only the immediate cause.
4. Describe fault-tree analysis, including the meaning of AND and OR relationships and the importance of dependency assumptions.
5. Discuss ethical, legal, and professional responsibilities in incident investigation.

3 Analytical / Application Questions

1. A solvent pump fire follows a process change, repeated seal leakage, an inhibited alarm, and delayed emergency isolation. Construct a causal analysis using direct, contributing, underlying, and root causes.
2. A facility completes 450 of 500 planned safety-critical tests on time. Calculate the on-time completion percentage and explain why this indicator alone cannot demonstrate effective fire protection.
3. A site reports no fires for two years, but overdue detector tests and near-miss reports have increased. Evaluate whether the site’s safety performance is improving and recommend additional indicators or investigations.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes origin from cause in a fire investigation?

A. Origin identifies the responsible employee, while cause identifies the damaged equipment.

B. Origin identifies where the event began, while cause explains the mechanisms and conditions that produced it.

C. Origin identifies the legal consequence, while cause identifies the insurance value.

D. Origin and cause are interchangeable terms.

Correct Answer: B. Origin identifies where the event began, while cause explains the mechanisms and conditions that produced it.

Question 2

What is the first priority after an industrial fire or explosion?

A. Collect debris samples

B. Interview all witnesses

C. Protect life and stabilise hazards

D. Calculate the incident frequency rate

Correct Answer: C. Protect life and stabilise hazards

Question 3

Which is an example of digital evidence?

A. A melted cable recovered from debris

B. A witness’s memory of a loud sound

C. A fire-damaged valve

D. A distributed-control-system alarm log

Correct Answer: D. A distributed-control-system alarm log

Question 4

In a fault tree, an AND gate indicates that:

A. Any one input is sufficient for the output

B. All specified input events are required for the output

C. The events are legally proven

D. The events are statistically independent

Correct Answer: B. All specified input events are required for the output

Question 5

Which is normally a leading indicator?

A. Number of completed safety-critical detector tests on time

B. Number of injuries after a fire

C. Value of property damaged

D. Number of explosions last year

Correct Answer: A. Number of completed safety-critical detector tests on time

Question 6

A site has 3 incidents in 600,000 hours and uses K = 200,000. What is the incident frequency rate?

A. 0.5 incidents per 200,000 hours

B. 1.0 incidents per 200,000 hours

C. 2.0 incidents per 200,000 hours

D. 3.0 incidents per 200,000 hours

Correct Answer: B. 1.0 incidents per 200,000 hours

Question 7

Which corrective action generally provides the strongest level of control?

A. A warning poster

B. Additional personal protective equipment

C. Elimination of the hazardous operation

D. A reminder during shift briefing

Correct Answer: C. Elimination of the hazardous operation

Question 8

Why should an investigation record uncertainty?

A. To avoid collecting evidence

B. To distinguish established facts from assumptions and hypotheses

C. To ensure every event is classified as unknown

D. To replace technical analysis with witness opinion

Correct Answer: B. To distinguish established facts from assumptions and hypotheses

Question 9

If 184 of 200 planned tests are completed on time, what is the completion percentage?

A. 82%

B. 90%

C. 92%

D. 96%

Correct Answer: C. 92%

Question 10

Why can increased near-miss reporting have more than one interpretation?

A. Near misses are never useful indicators

B. It may indicate deteriorating conditions or improved reporting culture

C. It proves that fires have already occurred

D. It always demonstrates poorer safety performance

Correct Answer: B. It may indicate deteriorating conditions or improved reporting culture