APPENDIX C Root Cause Failure Analysis Program Root Cause Failure Analysis Root cause failure analysis (RCFA) methodology is incorporated into the standard operating procedures in the McElmo Creek Unitfield area. Itprovides a structuredformatin analyzing an event and helps to determine necessary measures to preventfuture occurrences. The RCFA program includes the following components: Step I

- Notification Field supervisordetermines that an investigation is warranted and appoints personnel to conduct a root cause failure analysis foreach Flaring Incident, exceptforthose Flaring Incidents caused by scheduled maintenance or a CO 2 breakthrough. Step 2

- Plan Investigation Once the decision is made to investigate a Flaring Incident, the investigatordevelops an investigation strategy. To do this an investigatorcan use the information initially available to develop a preliminary Snap Chart (see attachment). This will help the investigator understand what happened, identify areas where more information is needed, and identify conflicting information. Foreach ofthe causal factors (problems) on the Snap Chart, the investigatorcan rapidly considerthe questions that need to be answered to identify root causes using the Root Cause Tree. With insightgained from using these two techniques, the investigatororthe investigation team can plan the initial investigation strategy by:

• Identifying the key plant parameters and event times that need to be checked to verify the incident’s sequence ofevents and technical accuracy.
• Identifying key pieces ofevidence (broken parts, logbooks, chart recorders, computer printouts, etc.) that need to be collected and preserved.

• Requesting copies ofthe applicable procedures that should have been used during the incident.

• Selecting an initial group ofindividuals forinterviews to fill in gaps in the information orto resolve conflicting information. Step 3

- Collect Information Collecting information (interviewing people and analyzing physical evidence) is an ongoing process throughoutthe investigation and crucial to understanding the incident and why it occurred. The investigator(s) are instructed to consultthe TapRoot UserGuides foreach technique.Step 4

- Determine Sequence ofEvents An investigatororteam collects several people’s perceptions ofwhathappened during an incident and the problems thatwere associated with the activities and equipment during an incident. The investigatorhas to blend these various perceptions into the story ofwhat happened. The besttechnique fordoing this is the Snap Chart. A Snap Chartis an excellent graphic tool. In developing the Snap Chart, the investigator organizes the information being collected on a graphical chartto betterunderstand it. This organization ofthe information often causes the re-evaluation ofassumptions orfacts that conflictwith other information. This organization also helps the investigatoridentify gaps in logic ofwhathappened. When you have team investigations or ifyou are interviewing several people at one time, drawing a Snap Charttogetherhelps facilitate gathering everyone’s information and increases the effectiveness ofmeetings orgroup interviews. During individual interviews, the investigatormay find it helpful to sketch a Snap Chartwith the interviewee to 

### verifytheir verbal communication. The investigator should keep a masterSnap Chart updated as “facts” are verified. Step 5

- Identify Incident’s Causal Factors Once the sequence ofthe incidentis thoroughly understood, the investigatorneeds to identify all the factors that, ifeliminated, would have prevented the incidentfrom occurring or would have significantly mitigated its consequences. These factors are called causal factors. Often investigators can identify the causal factors by simply inspecting the Snap Chartand asking, ifI could remove orcorrectthe problems identified on this chart, which ones would preventthis incidentfrom occurring or make it less severe?” A more formal technique is called BarrierAnalysis and is used as an optional approach to identifying the causal factors (which in barrieranalysis would be called broken barriers). In the next step, the investigator analyzes each causal factorfor its root cause(s) using the Root Cause Tree. Step 6

- Identify Root Causes Once the causal factors are identified, the next step is to identify the root causes. This is done using the Root Cause Tree. The Root Cause Tree Users Manual provides questions thathelp the investigatorpinpointthe incident’s root causes. The Human Performance Troubleshooting Guide on the Root Cause Tree helps an investigatordecide which human performance related causes need furtherinvestigation. It also ensures that experienced investigators considerall potential causes ofhuman performance difficulties (ratherthanjust concentrating on the ones thatthey understand the best). In some cases, the root causes ofan incidentare impossible to identify. When the Root Cause tree is used to analyze these difficult cases, the failure to identifythe rootcause is clear because the investigation stops before the lowestlevel on the Root Cause Tree is reached. A particularincidents specific rootcauses identified using the Root Cause Tree 

### are used in the next

### two steps to identify programmatic causes and to develop/evaluate corrective actions.Step 7

- Identify Generic (Programmatic) Causes The specific causes for a particular incident may stem from more pervasive problems

- generic or programmatic causes. Forexample, if a particular incident is caused by a valve not having a label plate, other incidents may occurbecause ofsimilar valve labeling problems with differentvalves. Therefore, the investigator needs to look at each specific cause for a particular incident and decide if a more program-wide weakness exists that needs broadercorrective action. Generic causes can be identified by investigating the pervasive nature ofthe problem. The pervasive nature ofthe problem can be determined by the investigator’s experience, performing a special programmatic evaluation, or by reviewing previous incident statistics. Correcting generic problems can have a much broader impact on safety, environmental performance, and reliability since they address whole classes ofproblems ratherthanjust the specific causes of an incident. Step 8

- Develop Corrective Action The specific and generic causes that are identified in steps 6 and 7 provide a list ofproblems that require corrective action implemented in a timely manner. No matterwhat corrective action is proposed, there is always a chance to somehow circumventthe intent ofthe corrective action. Therefore, proposing corrective actions for each cause identified (that is, multiple corrective actions) provides a defense-in-depth to preventing the incidentfrom recurring. In some cases, correcting a particular root cause may be too difficult. In these cases, the investigator should ensure thatthere are sufficient othercorrective actions proposed to reduce the likelihood ofthe incident’s recurrence. Ifthe root cause level was reached in the incident investigation, the corrective actions are usually fairly straightforward to identify. Ifthe investigatorGould not reach the root cause level, he/she will still need to develop ideas for corrective actions. Ifthe incident has been identified as a repeatofa similar past incident, the investigator should ask ifthe corrective actions proposed are differentfrom the corrective actions previously tried and why the previous corrective actions failed. Investigators should work with line management as much as possible when developing corrective actions. They should have thoughtful consideration to ensure the corrective actions recommended are SMART: S

- Specific M

- Measurable A

- Accountable R

- Reasonable T-Timely The investigator should develop a Corrective Actions Matrix Table to use in conjunction with the Snap Chartforeffective managementpresentations. The Corrective Actions Matrix should have headings as shown below: 

## ! Causal Factors Root Causes & Corrective Responsible Due Date For Generic Causes Actions Department & Corrective Person to Actions

. Implement Completion 

# rStep 9

- Report All ofthe information and analysis 

### performed up to this point allows the investigatorto write a clear, complete incident reportdescribing what happened, why it happened, and what needs to be corrected to preventthe incident (or similarincident), and make effective management presentations. Reports and presentations are extremely important because the case made therein often determines whetherthe recommended corrective action is expeditiously implemented oris given a low priority and delayed indefinitely. An important part ofincident reporting communication is the Snap Chart. A Snap Chart can be particularly helpful in providing an organized display ofwhat happened and why it happened. When used with the Corrective Actions Matrix described in step 8, these

### two tools make a powerful presentation ofmuch information in a shorttime to provide managementwith knowledge needed to make the best decisions about using resources to improve performance.

# ATTACHMENT

### Develop SnapCharT® Get Started

- Determme what you are investigating Define sequence ofevents

- Identify missing orneeded

information

- Investigate further to find missing

information Define causal factors



### Root Cause Analysis Analyze each Causal Factor’s Root Causes

- Analyze one Causal Factor at a

time

- begin at the top ofthe Tree and work

through the questions to determine what Basic Cause Categories apply

- Examine all ofthe Basic Cause

Categories that apply to determine whatroot causes apply Use the TapRoor® Root Cause Tree® Dictionary for definitions to all ofthe questions and root causes on the Root Cause Tree® 

# r: 1 ___



# ceO _



### •IIII 

# EziL:• 

# t’ I



# E 

# JJczI E E C r.

OCopynght 2000 by System Improvements Inc., Knoxville, TN. All Rights Reserved Worldwide. Duplication Prohibited.