WHY TREE AND ROOT CAUSE ANALYSIS

INCIDENT INVESTIGATION

WHY INVESTIGATE INCIDENTS

Determine Facts, Avoid Blame
Find Root Causes

Prevent Recurrence
Share Lessons

Meet Legal / Company requirements

Which Incidents?
An Incident could be : Injury Fatality Fire
Major Loss Business interruption

Release
Permit violations Equipment breakdown Legal liability Media attention

Near miss

How to conduct investigations

Incident Occurs

How to conduct investigations

Collect facts

How to conduct investigations

Form investigation team

How to conduct investigations

Develop time line

How to conduct investigations

Identify protective systems

How to conduct investigations

Determine root causes

How to conduct investigations

Develop recommendations

How to conduct investigations

Document investigation

How to conduct investigations

Share lessons learned

When to start investigation

As soon as possible within 48 hours
when it is safe to do so

Gather data as soon as possible

Interviews and written statements
weather , job and process status

written data: permits, JSAs, procedures,

control data, log sheets physical data:parts, equipment, photos, videotapes, sketches

interviews
Conduct interviews as soon as possible comfortable setting - try walking through the plant put interviewee at ease before questioning, explain that your purpose is fact finding, NOT fault finding

interviews
Ask open ended, non-leading questions and listen avoid speculation or implying blame in your questions use timeline and keep notes analyze what is said and obtain agreement close interview and thank interviewee

Incident investigation team

Facilitator Specialists

supervisor
employee/contractor involved

contractors
process operatives

Develop timeline
Use to organise facts - put all known facts on the timeline
- start timeline as far back as needed to identify all potential causes - include all responses to the incident

helps to prevent jumping to conclusions non-intimidating technique, helps focus on facts

Example timeline
date/time
1/4 9:34am 1/4 9:35am 1/4 9:37am 1/4 9:37am

activities
received low flow alarm notified operator operator observed major leak operator activated ESD

Identify protective systems

Definition: any management system or hardware system which reduces the potential for having the incident or the consequences of the incident

Identify protective systems

Shutdown/alarms
inert gas purging fire suppression hazard detection

Procedures training preventative maintenance

permit to work management of change PPE

emergency block valves

Root Causes

Root Cause : the most basic cause(s) that can reasonably be identified and that we have control to fix

Type of Causes
PHYSICAL - equipment or device changes or fails
HUMAN - human action or lack of action

SYSTEM - processes failed to support desirable human action

The Why Tree

Has many different forms namely:
block diagrams logic diagrams spread sheet

Why Tree Construction

Use timeline to determine primary event at the top of the tree
Identify the actions or conditions (and failed protections) which caused the primary event

Identify protective systems (continued)

Brainstorm all of the PHYSICAL causes (or causal factors) which reasonably could have caused the initial actions or conditions
Systematically rule out possible physical causes

Identify protective systems (continued)

Identify the HUMAN causes for each possible physical cause identify the system causes for each human cause: -why did the inappropriate action occur?
-what protective system failed to work to allow the action to occur?

Verify Each Causal factor

Visual Test / data Expert theory Conventional wisdom

When to Stop Asking Why

When you reach a normal condition or

when a system cause which we can fix has been identified

recommendations
Agree on how to eliminate the immediate hazard
Develop actionable recommendations for each root cause Prioritize recommendations based on the potential for eliminating the incident in the future

Recommendations (continued)
Assign responsibility for each recommendation Implement and track status to completion

Protective System Review

Confirm that why tree includes protective systems identified

document
Team Membership Investigation Results
-summary or incident -timeline -root causes (including how they were determined)

follow up recommendations Communicate lessons learned

Recommended Categories for Why Tree

Management commitment
Hazard analysis & risk based decision making procedures and safe work practices communications

Designs & reviews

pre-startup safety review inspection / quality control training

Recommended Categories for Why Tree (continued)

Preventative maintenance & repeat failure
human factors emergency response

Incident and near miss investigations contractor safety

management of change

audits

How to build an Events & Causal Factors Chart

1
Incident

Decide what is being investigated

Establish a sequence of "events"

What are causal factors & conditions for each event?

Very simple Events & Causal Factors chart example

1 - 4 causal factors/conditions reasons for an event or amplifying information

EVENTS progress from left to right, actions that describe what happened during incident

Reason for investigation

PERSON WALKS HOME

STEPS IN A HOLE

SPRAINS ANKLE

LEAVES LATE AFTER DARK 1

NO BARRICADE OR MARKINGS FOR HOLE 3

DECIDES TO TAKE A NEW ROUTE (SHORTCUT) 2

STREETLIGHT BROKEN 4

Exercise 1 Lube oil spill

A spill of 18 gallons of lube oil resulted from the equipment failure, specifically the failure of a 3/4 pipe nipple. The failure occurred due to excessive weight and size of the gauge installed on the nipple and vibration when fluid flows through the line. Excessive stress was placed on the nipple, resulting in metal fatigue. The gauge was not part of the original design detail and Management of Change was not used when the gauge was installed.

Lube oil spill

Lube oil spill occurs 3/4" nipple failed Metal fatigue

AND
Excessive weight and inadequate nipple Piping detail was not designed Or installed properly Design standards Not understood Vibration

Normal Condition

Installed as a field change Without proper review

MOC was not followed

MOC process not In place

Exercise 2 lube oil fire

On 19/5, a new Waukeshaw engine was installed for the main generator on a high priority. The job was inspected and turned over to operations on the 20/5. At 2:20PM, operations started the new engine. At 2:25PM, operations saw lube oil spraying out of a dresser coupling on the oil system.the oil contacted the bare exhaust piping and ignited.

Exercise 2 lube oil fire (continued)

The fire was immediately extinguished with a hand held extinguisher in the area. The investigation indicated that the dresser coupling had been on the original equipment. The new engine had a piping arrangement that was a little shorter than the original engine. Consequently, a proper seal was not obtained when the piping was connected. This was not noticed by the mechanics who were being pushed to complete the job.

Lube oil fire

Lube oil fire

AND
Lube oil leaked from Dresser coupling

Oil contacted hot Exhaust piping

AND
Old coupling did Not fit new engine and proper Seal not obtained New engine slightly Different-not a "change In kind"

NORMAL CONDITION

Mechanics did Not notice

No testing done prior to Turnover to operations

Management of change process did not discover problem, or no MOC process OR

Production given greater emphasis than proper installation and testing

Mechanics not required to complete testing prior To turnover