Jack Philley, CSP, Baker Engineering and Risk Consultants, Inc.
This paper presents practical lessons learned from
incident investigation physical evidence gathering, management, documentation,
and analysis experiences. Evidence provides the foundation for successful
identification of underlying root causes of incidents. Process safety events
are sometimes accompanied by severe consequences, and much of the evidence that
might otherwise be available has been destroyed by the event. Evidence
management is also critical in litigation and forensic concerns. This presentation provides an overview
of physical evidence issues associated with major process safety incidents,
such as fires, explosions and releases of hazardous materials. Potential
sources of useful evidence are addressed as well as the initial reconnoiter,
chain-of-custody, photography, evidence storage, and the significance of
gathering information on position evidence. There are a few simple measures
that investigators can take to prevent or minimize evidence spoilage to help
ensure successful identification of the underlying causes of the incident. This
presentation includes a summary of evidence analysis methods and resources.
Although the primary focus is on major catastrophic process related events, the
majority of information is also applicable to events with less severe
This paper presents an overview
of physical evidence collection, management, and analysis issues associated
with investigating chemical process incidents. As is the case for most investigation
functions, evidence collection and analysis is an iterative activity. For
optimum results, a formal system of evidence management is necessary. The
validity and value of the investigation results are a direct reflection of the
evidence examined by the team.
Many chemical process incidents, (such as fires,
explosions and releases of hazardous material) present significant physical
evidence challenges. The facility may be significantly damaged and critical
evidence may no longer exist or may not be initially available to
investigators. In some instances, the starting point may be a crater.
Regulatory agencies such as Occupational Safety and Health Administration,
Federal Bureau of Investigation, US Coast Guard, Environmental Protection Agency,
Alcohol Tobacco & Firearms, or Fire Marshal may have total control of the
site, and owner representatives may be prohibited from entry. Evidence
management is also critical in litigation and forensic concerns. In the United States, the site for many
chemical process incidents is declared an uncontrolled hazardous waste site
under the OSHA 1910.120 subpart (q) regulation and certain access controls and
actions become mandatory. In some instances, third party legal (or insurance
company) representatives may file legal action prohibiting the owner from
taking any action that could disturb potential evidence, thereby obstructing
any evidence gathering activity.
This presentation focuses on
physical evidence issues related to non-criminal incidents. While evidence from
witnesses is an important aspect of investigation, it is not included in the
scope of this paper.
The starting point for process
safety investigations can be challenging.
In many cases the plant infrastructure is severely damaged. Normal utilities
and services are unavailable, such as electrical power, telephones, and radio
communication systems. In large facilities, the undamaged portions of the plant
will be demanding permission to resume operations. Important witnesses who were
on duty at the time of the incident may not be available to the investigation
team due to injuries or may be at home recovering from extended hours spent in
the initial emergency response activities. The authority in control of the accident scene may be
confusing or inconsistently understood at times. Communications channels and information flow immediately
after the emergency response phase are most often uncoordinated, fragmented and
Physical evidence gathering,
handling, management, and analysis should follow accepted systematic scientific
methods and should be reproducible where applicable. Evidence analysis
calculations, tests, assumptions, and stipulations should be thoroughly
documented. When determining the causes of the incident, the speculated cause
scenarios should be generated based on the available evidence. It is a recognized mistake to
selectively consider only evidence that supports a preferred scenario, while
ignoring evidence that may point to other causes.
There are several recognized
categories of evidence.
(eyewitness & personal knowledge)
evidence (parts, things, equipment)
documents (historical, drawings, specifications)
parameters and conditions
properties and characteristics
In the most severe explosion
cases, a substantial portion of a process unit may be completely destroyed with
only a crater remaining in the location of the equipment. Fragments and debris can be thrown
considerable distances, sometimes outside facility boundaries. In many instances, sampling will be
necessary to evaluate potential exposures to investigation personnel (asbestos,
volatile organic compounds, blood borne pathogens and others). The default
position of many regulatory agencies is to assume the area is hazardous until
it can be proven that no hazard exposures continue to exist. The burden of proof falls on the owner
to verify the incident scene is safe.
For explosions, the damage itself
may function as a blast gage if the properties of the buildings and structures
are known. The end use of the evidence collection may include:
blast pressures and impulses at each damaged structure.
the explosion energy released.
the type of explosion.
the source of the explosion.
Potential Sources Of Physical Evidence
Depending on the type and nature
of the event, evidence prospecting may be required across a wide variety of potential
venues. Location and relative position of physical evidence should be
documented and in many instances, photographed in place before being moved. A
special type of information highly useful is the "as found" position
of valves, switches, control devices, or sequence indicators. Previous incident
reports and reports of process hazard analysis studies can provide insight as
to credibly possible failures and accident scenarios. Operating data such as
logbooks, computer records, Process Flow Diagrams, and Piping and
Instrumentation Diagrams are potentially very useful documents. Engineering
files, inspection records, and repair files contain valuable information on the
construction and features of fixed equipment. Management-of-Change records can
provide information related to modifications that may not be reflected on
equipment and system drawings. Score, scratch and impact marks made by moving
objects can be helpful.
Typical sources of evidence for chemical process incidents are listed in Table
Table 1. Potential
Sources of Evidence
(computer log, alarms, charts)
Instrument loop diagrams
Instrumentation Interlock drawings
Instrumentation Ladder logic
Material Safety Data Sheets
Management of Change records
ManufacturerĂs bulletins and Original
Equipment Manufacturers Manual
Retainer Samples of shipments and
incoming raw materials
¦As-found" position of valves, switches, & indicators
Rupture disk condition
in damage (or non-damage)
Layering of debris
Direction of glass pieces
Analysis of undamaged areas &
Security camera tapes
Previous Process Hazard Analysis
Chemical reactivity data
Prior incident reports
Time Sensitive Physical Evidence
Some physical evidence is extremely
time-sensitive and requires top priority in the initial stages of the
investigation. Physical evidence degrades with time (examples include: fracture
surfaces, dust and soot samples, residual liquids, and charts, logs and other
paper records that are exposed to the elements). Availability and integrity of
electronic process data can be impacted by the loss of normal or back-up
electrical power. Digital evidence
is fragile by nature. Perhaps the single most important issue related to
collecting digital evidence is securing the media where the digital evidence
exists. Digital data can be irreversibly
corrupted due to loss of electrical power or uncoordinated attempts to reboot a
Some aspects of offsite physical
evidence can be extremely time sensitive, and the owner usually does not have
control of these offsite activities. Temporary repairs may be needed to damaged
homes. Cleanup of streets and removal of hazardous offsite debris (broken glass
and metal shards for example) may need to be completed to prevent additional
injury. Access to offsite evidence
and restoration of offsite damage is not in the control of the chemical process
Documentation of the extent of
damage and necessary temporary repairs are high priority evidence issues.
Within the plant or facility boundaries, evidence collection requires
notification and coordination of all employees to minimize loss or inadvertent
alteration of the physical evidence. Evidence may be spread over a large area,
and all personnel within the plant should be instructed on the proper manner to
communicate the location of evidence for collection by a trained team.
Collection of chemical samples from vessels that are open to the atmosphere is
a high priority activity. This
will ensure the sample is as representative as possible and will minimize
adverse impacts from exposure to the elements (evaporation, moisture and
others). Some evidence may be located in access ways and other places that need
to be cleared quickly, and these areas may need to be placed on the high
Hazard Exposures To Evidence Gatherers
Field investigation activities
are often conducted in less than ideal circumstances. Investigators can be
exposed to a variety of hazards. One of the most common hazards is the constant
potential for slips, trips, or falls created by unstable working and walking
surfaces. Accident scenes are frequently populated by sharp metal edges from
debris and broken glass. Investigators can be injured by debris falling from above
that becomes unstable by vibration or shifting rubble piles.
Hazard exposures include
radiation from nuclear instrumentation devices, and stored potential energy in
the form of hydraulics, pneumatic, spring energy and elevated mass. One of the
initial tasks conducted by emergency response personnel is isolation of all
known sources of electrical energy and fuel. The investigation team should
conduct an independent verification that all electrical power and
interconnecting piping (gas pipelines for example) are isolated, deenergized
where appropriate, and secured against unauthorized operation. It is not uncommon to find energized
electrical circuits that were installed during construction and are not accurately
depicted on electrical power distribution documents. Airborne contaminates from
uncontrolled releases of process materials represent another potential hazard
exposure. The team may need to conduct sampling to assess the need for
additional cleanup or use of personal protective respiratory equipment.
During the investigation, team
members will often have need to access elevated or constricted space to make
observations or gather evidence. Access to elevated locations may have to be
made by crane basket or special scaffolding. Team members may need to be
competent in the use of fall protection devices. In major accidents, the
investigators may be exposed to biohazards. As mentioned earlier in Section 2,
the site may be classified and an uncontrolled hazardous waste site, therefore,
the team may need to implement OSHA 1910.120 Hazardous Waste and Emergency
Response control measures. Regardless, the investigation team should be
prepared for emergencies that could occur during the course of the
investigation, such as releases of materials or injuries to team members. It is
a good practice to implement emergency alarm, alert and communication
capabilities and procedures for the investigation team.
Evidence Collection And Management
One important activity is the initial visit to the scene.
An effective technique for conducting this important event is the Initial
Reconnoiter. The objective of this activity
is to gain an overview of the entire incident scene before becoming overly
focused on the apparent center of the event. The investigator (or in some cases
the entire investigation team) conducts a slow, deliberate and systematic
circuit from outside the accident scene.
During this circuit the investigator should:
for potential safety hazard exposures to the investigation team.
at the big picture, not just the micro (trees).
what is not damaged.
all senses (smell, sounds, physical sensations of pressure, heat, vibration).
intentional pauses to observe the scene from multiple angles and elevation.
For major chemical process
incidents, evidence preservation, storage, and management is required.
Effective collection and analysis of physical evidence should be conducted in a
systematic fashion. All potentially important fragments, debris, and other
physical items should be documented in place (by photography or other means)
before being moved or disturbed in any manner, noting the location and
orientation. It is standard practice to assign individual evidence numbers to
each piece of physical evidence collected. In most instances, small items are
placed in clear plastic bags.
A formal chain-of-custody system
is developed and implemented to track the status of, and access to, any
evidence not retained in the custody of the incident investigation team.
Disassembly of equipment should be documented with photography and annotated at
each significant stage. Long-term storage of physical evidence may be required
for investigations that involve potential litigation. It is important to
arrange for secure storage, restricted access, and chain of custody management
for items that may be retained long after the initial investigation team has
concluded its work. Regulatory
agencies and other third parties may have need for copies of documentation as
well as samples, photographs, and portions of physical evidence. It is
important to manage the distribution copies of documents and other evidence in
order to avoid unnecessary confusion and differences in interpretation of
In most cases, it is necessary to
handle physical evidence at some point in the investigation. Any time physical evidence is moved or
disturbed, there is opportunity for evidence spoliation. Evidence spoliation is
defined as ¦Significant and meaningful alteration",
and this term is very broadly interpreted by some courts. In some instances, potential spoliation
can become a major litigation concern. It is a good practice to provide advance
notice to all potentially interested parties whenever a major piece of evidence
is scheduled to be moved or when there is a plan for sampling of remaining
materials. In some instances the actual sampling is video taped and samples
split among interested parties, with a retain sample kept for future reference.
Investigation photography (and
video) has multiple purposes. It is most often used to document the "as
found" position, location,
configuration arrangement, damage pattern, and layering of physical evidence.
In addition, photographic evidence is often useful in presenting the results of
the investigation (reports) and in distributing lessons learned (training).
Photographs taken by the investigation team find application in evidence
analysis and in litigation activities. Photographs can be taken of items that
need to be moved or of items and conditions that might change over the course
of the investigation. Promptness is important since no accident scene can be
considered frozen in time. In most instances, the investigation team should
generate a formal log that includes each image, indicating the date, time,
identity of the photographer, and intended purpose or contents of the image. If
multiple copies are distributed, there should be a record of the distribution.
Some investigators have found it helpful to document the view of each
significant witness by going to the location of the witness and recording what
the witness was able to see from his position. A general rule used by most
investigators is to consider every photograph to be discoverable in the event
of a lawsuit.
Conventional 35 mm photography,
digital photography, instant print, and video images all have a place in the
investigation process. In some instances, the use of a professional
photographer may be appropriate, however in most instances, photography will be
done by investigation team members. It is important to capture a series of
overall orientation views from multiple perspectives and from multiple
distances. These views will significantly enhance the value of subsequent
photos that are taken from a closer distance. A sometimes-used resource for video is news media footage
taken during the incident. This un-edited footage is available directly from
the TV station and can provide clues related to the sequence of the event.
All photographic equipment will require
perishable batteries that have, in some cases, unpredictable battery life. It
is a good practice to implement a system to ensure that spare batteries are
available and that periodic battery change-out and recharging occurs.
Photographic film is date sensitive and in addition, can be adversely affected
by airport security screening devices. It is a recognized best practice to
provide special x-ray resistant film carrying bags. Storage of electronic
digital images needs to be managed, with master copies or back-up copies
maintained in a controlled manner. Autofocus systems have several undesirable
features that can cause unintended results. The color black is invisible to
most autofocus systems since they operate in the InfraRed range and therefore,
black (or burnt) objects may be out of focus. When shooting through a clear
surface such as a window, the camera may focus on the window itself and cause
items on the far side of the window to be out of focus.
Photography can present hazards
to investigators. The view through the lens is restricted and the photographer
may not be aware of tripping and falling hazards. Photographic and flash
equipment devices are not designed for use in potentially flammable vapor
conditions and require precautions similar to those used for any potentially
spark producing tool or piece of equipment. Good practices for investigation
multiple orientation views from different positions and distances.
an object of known size in the picture.
aware of potential shadows that will be cast by the flash unit.
spare battery supply.
a detailed log of all photographs.
and documenting distribution of duplicate copies.
Evidence analysis can provide
objective and scientific independent confirmation of the cause scenario
speculated by the investigation team. Damage patterns provide information
related to the origin and sequence. Investigators can also make useful
determinations based on anomalies and by analyzing what remains undamaged.
Experienced investigators ask the questions:
is present that would not be expected to be present?" and the companion
÷ ¦What is absent that would be expected
to be present?"
was different in this instance, why did the incident happen this time and not
There are numerous publicly
available resources for evidence analysis, including physical property data for
melting temperatures, autoignition temperatures, and chemical
incompatibilities. Some methods are non-destructive (Non Destructive Evaluation
[NDE]), while others require permanent modification of the evidence. Visual examination is the most common
and one of the most powerful evidence analysis techniques. NDE Integrity
testing can include leak checking, x-ray radiography, ultrasonic thickness
testing, physical measurements, magnetic particle testing, and others. Two
useful references are the National Fire Protection Association standards # 921
for Fire and Explosion Investigations and
# 907 Determining Electrical Fire Causes.
Although these two references are prepared for use primarily by
municipal fire protection agencies and organizations, they do contain
information helpful to industrial investigators. For example, tables from NFPA
921 present autoignition (Table 3.3.4) and melting (Table 4.8) temperatures for
specific commercial materials. NFPA 921 also includes an interesting section on
Human Response to Fire (Chapter 8), interview techniques, and helpful
information on preparing sketches and diagrams. Another useful reference in
fire and explosion evidence analysis is the Materials Technology Institute
Publication 30, Guidelines for Assessing Fire and Explosion Damage.
This publication uses a temperature profile to assist in determining fire cause
The technical disciplines of
structural analysis, dynamic structural analysis, and finite element analysis
are powerful tools to study complex response modes. Permanent deformation is
used as a ¦blast gage". The amount
of deformation is measured and compared to the expected properties of the
material and type of construction configuration. This information is then used
to develop a pressure-impulse diagram to estimate the forces experienced on the
structure or structural member being analyzed.
Metallurgical and failure
analysis of evidence, fractured physical evidence, and failed equipment can
provide valuable information regarding the nature, sequence, and cause of the
incident. The mode of fracture (ductile or brittle) can indicate pressure and
impulse forces. The direction and style of crack propagation is often helpful.
Metallurgical analysis can help determine the age, origin, and reason for the
failure. Cause and type of corrosion attack can be determined and can provide
evidence of contaminants or corrosion
not expected to be present. Temperature at time of failure can be
determined. The actual fracture pattern can provide an indication of the
conditions at the time of failure.
There are several types of
chemical analysis techniques that can be helpful in identifying the cause and
sequence of the event. Chemical analysis can be conducted to confirm or refute
the presence of compounds, substances, trace impurities, or gross contaminants.
Retained samples of raw materials and final products are often re-analyzed to
help refute a lower probability scenario. Residues remaining after a fire can
still provide useful chemical evidence. Physical property testing is useful in
analyzing or confirming potential fire, reactivity, stability, solubility, or
contamination concerns. Gas chromatography and Scanning Electron Microscopy
(SEM) are two common methodologies.
Arson is a special case and in
many instances, will leave tell-tail unique evidence. Most fire departments,
law enforcement agencies, and insurance companies have in-house experts
available to assist if there is a suspicion of malevolent action. There are
well-established char and burn patterns for most common building materials and
components that can indicate the nature of the fire.
Arson investigators look for atypical patterns and the presence of accelerators
and ignition devices.
A discussion of analysis of damage patterns is beyond the
scope of this overview presentation, however, the following examples and resources
are offered. NFPA 921 Standard contains significant information related to
damage criteria for a variety of topics. Table 126.96.36.199b lists typical damage
effects caused by various overpressure conditions on typical building
components. Melting, boiling, and autoignition temperatures for many substances
are included in NFPA 921. By noting the melting patterns and char depth, the
investigation team has an opportunity to generate temperature profiles of a
fire scene. Smoke trace patterns, scorch and heat distortion patterns are very
helpful to fire investigators. The size and location of fragments provides
valuable clues to determining the source of an explosion. Missile mapping is
one technique to evaluate explosion damage. Each fragment is plotted with
distance traveled and mass of the fragment considered when estimating the
amount of energy released. NFPA 907 provides a guide for determining electrical
causes and includes information on examining and analyzing the end segments of
wiring components to assist in identifying causes.
Since evidence provides the foundation for
understanding the event scenario and discovering the underlying causes, it is
necessary that evidence collection and management be conducted in a systematic
fashion, with careful documentation.
For major incidents, exercising good evidence management practices can
return substantial benefits and avoid unnecessary consequences. Systematic management of physical
evidence can also minimize litigation challenges to the credibility, integrity
and accuracy of the investigation findings.
 ¦Guidelines for Investigating Chemical Process
Incidents", 2nd edition, 2003, Center
for Chemical Process Safety, American Institute of Chemical Engineers, NY, NY, ISBN
 Laykin, Erik, ¦What are the first steps in
securing digital evidence? Online
Security Inc, International Business Law Services, Irvine CA
 ¦Fire and Arson Scene Evidence: A Guide for Public
Safety Personnel", National Institute
of Justice Report NCJ 181584, June 2000, US Department of Justice, Washington
 ¦A Guide for Explosion and Bombing Scene
Investigation" National Institute of
Justice Report NCJ 1818679, June 2000, US Department of Justice, Washington DC
 Teig, Joe ¦Preserving Evidence of Disaster", Holland and Hard, Jackson, WY
 National Fire Protection Association "¦Standard
921 Investigating Fires and Explosions"
NFPA Batterymarch Ave, Boston MA
 ¦Guidelines for Assessing Fire and Explosion
Damage" MTI Publication 30, 1990,
Materials Technology Institute of the Chemical Process Industries, Cortest
Labs, Cypress, TX 77429
 Redsicker, D.R. and OĂConnor J.J., ¦Practical Fire
and Arson Investigation", 2nd
Edition, 1997, CRC Press, New York, NY, ISBN 0-8493-8155-X