# McElmo Creek Unit Oil Production Facility

PSD Permit No. NU 05

- 01

A PP EN D I X B



# MCELMO CREEK UNIT

ROOT CAUSE FAILURE A NALYSIS

PROGRAM

September 2016

T h i s d o c u m e n t s h a l l a p pl y t o t h e o w n er ( s ) a n d o p er a to r ( s ) of th e Mc E l m o Creek

U n i t Oi l Pr od u c ti o n F a c i li t y
, in c l u d i n g R e s ol u t e N a t u ral Re s ou r ces C o m p a n y,

LLC

.McElmo Creek Unit Oil Production Facility

McElmo Creek Unit O&M Plan

– Lifecycle Maintenance Plan

PSD Permit No. NU 05

- 01, Appendix A, Attachment A

- 1 September 2016 Page 1 of 5 

### McElmo Creek Unit

Root Cause Failure Analysis Program

PSD Permit No. NU 05

- 01, Appendix B

September 2016

Root Cause Failure Analysis

Root cause failure analysis (RCFA) methodology is incorporated into the standard operating procedures in the McE l mo Creek Unit field area. It provides a structured format in analyzing an event and helps to determine necessary measures to prevent future oc currences. The RCFA program includes the following components:

Step 1

– Notification

Field supervisor determines that an investigation is warranted and appoints personnel to conduct a root cause failure analysis for each Flaring Incident, except for those Flaring Incidents caused by scheduled maintenance or a

CO 2 breakthrough

.

Step 2

– Pl an Investigation

Once the decision is made to investigate a Flaring Incident, the investigator develops an investigation strategy. To do this an investigator can use the information initially available to develop a preliminary Snap C hart (see

A ttachment B

- 1 ). This will help the investigator understand what happened, identify areas where more information is needed, and identify conflicting

information.

For each of the causal factors (problems) on the Snap Chart, the investigator can rapidly consider the questions that need to be answered to identify root causes using the Root Cause Tree.

With insight gained from using these two techniques, the investigator or the investigation team can plan the initial investigation strategy by:

• Identifying the key plan t parameters and event times that need to be checked to verify the incident's sequence of events and technical

accuracy.

• Identifying key pieces of evidence (broken parts, logbooks, chart recorders, computer printouts, etc.) that need to be collected andMcElmo Creek Unit Oil Production Facility

McElmo Creek Unit O&M Plan

– Lifecycle Maintenance Plan

PSD Permit No. NU 05

- 01, Appendix A, Attachment A

- 1 September 2016 Page 2 of 5 preserved.

• Requesting copies of the applicable procedures that should have been used during the incident.

• Selecting an initial group of individuals for interviews to fill in gaps in the information or to resolve conflicting information.

Step 3

– Collect Information

Collecting information (interviewing people and analyzing physical evidence) is an ongoing process throughout the investigatio n and crucial to understanding the incident and why it occurred. The investigator(s) are instructed to consult

the TapRoot User Guides for each technique.

Step 4

– Determine Sequence of Events

An investigator or team collects several people's perceptions of what happened during an incident and the problems that were associated with the activities and equipment during an incident. The investigator has to blend these various perceptions into the story of what happened. The best technique for doing this is the Snap Chart.

A Snap Chart is an excellent graphic tool. In developing the Snap Chart, the investigator organi zes the information being collected on a graphical chart to better understand it. This organization of the information often causes the re

evaluation of assumptions or facts that conflict with other information. This organization also helps the investiga tor identify gaps in logic of what happened.

When you have team investigations or if you are interviewing several people at one time, drawing a Snap Chart together helps facilitate gathering everyone's

information and increases the effectiveness of meetin gs or group interviews. During individual interviews, the investigator may find it helpful to sketch a Snap Chart with the interviewee to verify their verbal communication. The investigator should keep a master Snap Chart updated as "facts" are verified.

Step 5

– Identify Incident's Causal Factors

Once the sequence of the incident is thoroughly understood, the investigator needs to identify all the factors that, if eliminated, would have prevented the incident from occurring or would have significantly mitigated its consequences.

These factors are called causal factors.

Often investigators can identify the causal factors by simply inspecting theMcElmo Creek Unit Oil Production Facility

McElmo Creek Unit O&M Plan

– Lifecycle Maintenance Plan

PSD Permit No. NU 05

- 01, Appendix A, Attachment A

- 1 September 2016 Page 3 of 5

Snap Chart and asking, "If I could remove or correct the problems identified on
this chart, which ones would prevent this incident from occurring or make it less severe?" A more formal technique is called Barrier Analysis and is used as an optional approach to identifying the causal factors (which in barrier analysis would be called broken barriers). In the ne xt step, the investigator analyzes each causal factor for its root cause(s) using the Root Cause Tree.

Step 6

– Identify Root Causes

Once the causal factors are identified, the next step is to identify the root causes. This is done using the Root Cause Tree. The Root Cause Tree User's Manual provides questions that help the investigator pinpoint the

incident's root causes.

The Human Performance Troubleshooting Guide on the Root Cause Tree helps an investigator decide which human performance related cau ses need further investigation. It also ensures that experienced investigators consider all potential causes of human performance difficulties (rather than just concentrating on the ones that they understand the best).

In some cases, the root causes of a n incident are impossible to identify. When the Root Cause Tree is used to analyze these difficult cases, the failure to identify the root cause is clear because the investigation stops before the

lowest level on the Root Cause Tree is reached.

A particu lar incident's specific root causes identified using the Root Cause Tree are used in the next two steps to identify programmatic causes and to develop/evaluate corrective actions.

Step 7

– Identify Generic ( Programmatic) Causes

The specific causes for a particular incident may stem from more pervasive problems

- generic or programmatic causes. For example, if a particular incident is caused by a valve not having a label plate, other incidents may

occur because of similar valve l abeling problems with different valves. Therefore, the investigator needs to look at each specific cause for a particular incident and decide if a more program

- wide weakness exists that

needs broader corrective action.

Generic causes can be identified by investigating the pervasive nature of the problem. The pervasive nature of the problem can be determined by the investigator's experience, performing a special programmatic evaluation, or by reviewing previous incident statistics.

Correcting generic pro blems can have a much broader impact on safety,McElmo Creek Unit Oil Production Facility

McElmo Creek Unit O&M Plan

– Lifecycle Maintenance Plan

PSD Permit No. NU 05

- 01, Appendix A, Attachment A

- 1 September 2016 Page 4 of 5 environmental performance, and reliability since they address whole

classes of problems rather than just the specific causes of an incident.

Step 8

– Develop Corrective Action

The specific and generic causes that are identified in steps 6 and 7 provide a list of problems that require corrective action implemented in a timely manner. No matter what corrective action is proposed, there is always a chance to

somehow circumvent the intent of the correctiv e action. Therefore, proposing corrective actions for each cause identified (that is, multiple corrective actions) provides a defense

- in

- depth to preventing the incident from recurring. In some cases, correcting a particular root cause may be too difficu lt. In these cases, the investigator should ensure that there are sufficient other corrective actions proposed to reduce the likelihood of the incident's recurrence.

If the root cause level was reached in the incident investigation, the corrective actions are usually fairly straightforward to identify. If the investigator could not reach the root cause level, he/she will still need to develop ideas for corrective acti ons. If the incident has been identified as a repeat of a similar past incident, the investigator should ask if the corrective actions proposed are different from the corrective actions previously tried and why the previous corrective actions failed.

Investigators should work with line management as much as possible when developing corrective actions. They should have thoughtful

consideration to ensure the corrective actions recommended are SMART:

• S

– Specific

• M

– Measurable

• A

– Accountable

• R

– R easonable

• T

– Timely

The investigator should de velop a C orrectiv e Actions Matrix Table which

include s the fo llowing information :

• Causal Factors

• Root Causes & Generic Causes

• Corrective ActionsMcElmo Creek Unit Oil Production Facility

McElmo Creek Unit O&M Plan

– Lifecycle Maintenance Plan

PSD Permit No. NU 05

- 01, Appendix A, Attachment A

- 1 September 2016 Page 5 of 5 • Responsible Department & Person to Implement

• Due Date for Corrective Actions Completion

Step 9

– Report

All of the information and analysis performed up to this point allows the investigator to write a clear, complete incident report describing what happened, why it happened, and what needs to be corrected to prevent the incident (or similar incident), and m ake effective management presentations. Reports and presentations are extremely important because the case made therein often

determines whether the recommended corrective action is expeditiously implemented or is given a low priority and delayed indefinitely.