U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD



# INTERIM INVESTIGATIO N REPORT

C HEVRON 

# R ICHMOND 

# R EFINERY 

# F IRE

C HEVRON 

## R ICHMOND 

## R EFINERY



## R ICHMOND 

## , C ALIFORNIA



## A UGUST 

## 6, 2012



## K EY 

## I SSUES

**•** I NHERENTLY 

### S AFER 

### D ESIGN



### • D AMAGE 

### M ECHANISM 

### H AZARD 

### R EVIEW



### • E FFECTIVE 

### A NALYSIS OF 

### P ROCESS 

### S AFEGUARDS IN 

### P ROCESS 

### H AZARD 

### A NALYSISChevron Richmond Refinery Interim Investigation Report April 2013

U.S. C HEMICAL S AFETY AND HAZARD I NVESTIGATION B OARDChevron Richmond Refinery Interim Investigation Report April 2013

3 U.S. C HEMICAL S AFETY AND HAZARD I NVESTIGATION B OARD 

## Summary

On August 6, 2012 , the Chevron U.S.A. Inc. Refinery in Richmond, California

, experienced a catastrophic pi pe failure in the #4 Crude Unit. The pipe ruptured, releasing flammable, hydrocarbon process fluid which partially vaporized into a large vapor cloud that engulfed nineteen Chevron employees. A ll of the employees escaped, narrowly avoiding serious injury. The flammable portion of
the vapor cloud ignited just over two minutes after the pipe ruptured

. The ignition and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of unknow n and unquantified particulates and vapor traveling across the Ric hmond, California

, area. In the weeks following the incident, approximately 15,000 people from the surrounding area sought medical treatment
due to the release. Testing commissioned by the U.S. Chemical Safety and Hazard Investigation Board (CSB) and the California Division of Occupational Safety and Health ( Cal/OSHA ) determined that the pipe failed due to thinning caused by sulfidation corrosion, a common damage mechanism in refineries.
A s a result of the incident, the Chevron Richmond Refinery crude unit remains out of commission over eight months later . In addition, Cal/OSHA issued the refinery 17 citations related to the incident and eight additional citations

, with a total proposed fi ne of nearly one million dollars. In this interim report, the CSB is issuing recommendations to Chevron, the C ity of Richmond, Contra Costa County

, Cal/OSHA, the State of California , and the U.S. Environmental Protection Agency , addressing the need for inherently safer design, rigorous and documented damage mechanism hazard reviews, and thorough analyses of process safeguards.

This interim investigation report contains detailed analyses of and makes recommendations to Chevron
and regulatory bodies at the local, state, and federal level . T he CSB believes the findings and
recommendations presented in this report can be applied to refineries, chemical plants, and other
industries nationwide to improve process safety.

The CSB plans to release a comprehensive Final Investigation Report later in 2013 that will include analys e s and recommendations relating to technical and regulatory investigation findings which are not included in this interim report . The Final Investigation Report will cover topics including: the importance of having a competent, well

- funded regulator and an adaptable regulatory regime ; Chevron saf ety culture ; process safety indicator data collection and reporting ; emergency planning and response ; stop work

a uthority ; and recommendations for improvement of petroleum industry standards and recommended practices. Some of these issues are previewed at the end of this interim report under Additional Issues Currently Under Investigation

.Chevron Richmond Refinery Interim Investigation Report April 2013

4 U.S. C HEMICAL S AFETY AND HAZARD I NVESTIGATION B OARD 

## Table of C ontents

Figures

................................ ................................ ................................ ........................ 5

Acronyms and Abbreviations

................................ ................................ .................... 6

Backgr ound and Findings

................................ ................................ .......................... 8

Sulfidation Corrosion

................................ ................................ ............................... 16

Sulfidation Corrosion Inspection Techniques

................................ .......................... 21

Chevron Sulfidation Corrosion Knowledge and Ex pertise

................................ ..... 24

Other Significant Sulfidation Occurrences

................................ .............................. 27

Process Hazard Analysis

................................ ................................ .......................... 31

Operatio nal Changes

................................ ................................ ................................ 33

Chevron Sulfidation Corrosion Inspection and Mitigation

................................ ..... 36

Inherently Safer Systems

................................ ................................ ......................... 40

Regulatory Oversight

................................ ................................ ............................... 46

Recommendations

................................ ................................ ................................ .... 53

Additional Issues Currently Under Investigation

................................ .................... 59

Regulatory Oversight

................................ ................................ ............................ 59
Emergency Planning and Reporting

................................ ................................ ..... 61
Emergency Response

................................ ................................ ............................ 62
Safety Culture

................................ ................................ ................................ ....... 62

References

................................ ................................ ................................ ................ 65Chevron R ichmond Refinery Interim Investigation Report April 2013

5 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Figures

Figure 1. The burned remains of the fire truck that was consumed by the fire.

................................ ............ 9

Figure 2. Vapor cloud over Richmond area and smoke from Chevron Richmond Refinery fire

............... 10

Figure 3. Initial vapor cloud formation and subsequent ignition

................................ ................................ 11

Figure 4. C

- 1100 Crude Unit Atmospheric Column and Upstream Process Equipment

............................ 12

Figure 5. Overhead view of the equipment in the #4 Crude Unit

................................ ............................... 13

Figure 6. 4

- sidecut line configura tion....................................

............................................ 14

Figure 7. Photo of rupture on 4

- sidecut 52

- inch component

................................ ................................ ...... 15

Figure 8. Graph showing how corrosion rates increase in carbon steel.

................................ ..................... 18

Fig ure 9. 4

- sidecut piping sample

................................ ................................ ................................ .............. 20

Figure 10. Modified McConomy Curves from API RP 939

- C

................................ ................................ ... 23

Figure 11. Chevron’s key sulfidation events between 1974 and 2013.

................................ ...................... 24

Figure 12. Schematic of failed piping from the Chevron Salt Lake Refinery.

................................ ........... 28

Figure 13. Failed piping component that resulted in the 2007 Richmond crude unit fire.

.......................... 29

Figure 14. Percentage increase of the sulfur content in the 4

- sidecut.

................................ ........................ 34

Figure 1 5 . Key events at the Richmond refinery between 1998 and 2013.

................................ ................ 36

Figure 1 6 . Hierarchy of controls.

................................ ................................ ................................ ................ 41Chevron R ichmond Refinery Interim Investigation Report April 2013

6 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Acronyms and Abbreviations

ALARP As Low As Reasonably Practicable

API American Petroleum Institute

ASTM American Society for Testing and Materials

BIN Business Improvement Network

bpd Barrels Per Day

BPTC BP Texas City

CAA Clean Air Act

Cal/OSHA California Division of Occupational Safety and Health

CCPS Center for Chemical Process Safety

CCR California Code of Regulations

Chevron ETC Chevron Energy Technology Company

CML Co ndition Monitoring Locations

CSB U.S. Chemical Safet y and Hazard Investigation Board

CSHO Compliance Safety and Health Officer

CWS Community Warning System

EPA Environmental Protection Agency

° F degree Fahrenheit

HSE Health and Safety Executive

ISO Industrial Safety Ordinance

ISS Inherently Safer Sys tems

IST Inherently Safer Technology

KPI Key Process IndicatorChevron R ichmond Refinery Interim Investigation Report April 2013

7 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD LEPC Local Emergency Planning Committee

LOPA Layers of Protection Analysis

MOC Management of Change

NEP National Emphasis Program

OEM U.S. EPA Office of Emergency Management

OSHA Occupa tional Safety and Health Administration

P&P Policy and Procedures

PHA Process Hazard Analysis

PMI Positive Materials Identification

psig Pounds Per Square Inch Gauge

PSM Process Safety Management

RISO City of Richmond Industrial Safety Ordinance

RLOP Richmond Lube Oil Project

RMP Risk Management Plan

SIP Shelter

- In

- Place

TML Thickness Monitoring Location

UK United Kingdom

USW United Steelworker International Union

wt. % Weight PercentChevron R ichmond Refinery Interim Investigation Report April 2013

8 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Background and Findings

1. On August 6, 2012 , the Chevron U.S .A

. Inc. Refinery in Richmond, California (Chevron Richmond Refinery)

, experienced a catastrophic pipe rupture in the #4 Crude U nit (crude unit)

. The ruptured pipe released a flammable hydrocarbon process fluid which then partially vaporized into a large v apor cloud that engulfed nineteen Chevron U.S.A. Inc. (Chevron) employees. At 6:33 pm, approximately two minutes after the release, the flammable portion of
the vapor cloud ignited. i

i Surveillance footage provided by Chevron. Chevron clarified to CSB that video time is approximately 5 minutes out of sync. The video can be found at Eighteen of the employees safely escaped from the cloud just before ignition; one emplo yee , a firefighter

, was inside a fire engine that caught fire when the vapor cloud ignited (Figure 1). Because he was wearing full body fire

- fighting protective equipment, he was able to make his way to safety. Six Chevron employees su ffered minor injuries during
the incident and subsequent emergency r esponse efforts

.

http://www.csb.gov/videoroom/detail.aspx?VID=69 (accessed February 8, 2013).Chevron Richmond Refinery Interim Investigation Report April 2013

9 U.S. C HEMICAL S AFETY AND HAZARD I NVESTIGATION B OARD Figure 1 . The burned remains of the fire truck that was consumed by the fire. A firefighter was in the cab when the vapor cloud ignited. The fire truck was positioned approximately 65 feet from the leak location.Chevron Richmond Refinery Interim Investigation Report April 2013

10 U.S. C HEMICAL S AFETY AND HAZARD I NVESTIGATION B OARD 2. The ignition and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume of unknown and unquantified particulates and vapor traveling across the Ric hmond,
California

, area (Figure s 2 and 3 ). This resulted in a Community Warning System (CWS) Level
3 alert

, i and a shelter

- in

- place ii (SIP) was issued at 6:38 pm 1 for the cities of Richmond, San Pablo, and North Richmond. It was lifted later that night at 11:12 pm after the fire was fully
under control. In the weeks following the incident, n earby medical facilities received over 15,000 members of the public seeking treat ment for ailments including breathing problems,
ches t pain, shortness of breat h, sore throat, and headaches. Approximatel y 20 people were
admitted to local hospital s as inpatients for treatment.

Figure 2

. Vapor cloud (white) over Richmond area and smoke (black) from Chevron Richmond Refinery fire as seen from San Rafael in Marin County

. 2

i A Community Warning System Level 3 alert indicates that a facility within Contra Costa County has had a release that has offsite impact and is categorized by any of the following: 1. Off

- site impact that may cause eye, skin, nose and/or respiratory irritatio n to the general population. 2. Fire, explosion, heat, or smoke with an off

- site impact. Example: On a process unit/storage tank where mutual aid is requested to mitigate the event and the fire will last longer than 15 minutes. 3. Hazardous material or fire inci dent where the incident commander or unified command, through consultation with the Contra Costa Health Services Hazardous Material Incident Response Team, requests that sirens should be sounded. See http://cchealth.org/hazmat/pdf/incident_notification_policy.pdf (accessed April 9, 2013).
ii Contra Costa County considers a shelter

- in

- place to include going inside a home or nearest building, closing doors and windows, and turning off heating, ventilation, and air conditioning. See http://cchealth.org/emergencies/shelter

in

- place.php (accessed February 6, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

11 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 3

. Initial vapor cloud formation (white cloud) and subsequent ignition (black smoke ) as seen from a pier in San Francisco, California

.

3. The incident occurred from the piping referred to as the “4

- sidecut ” stream, one of several process streams exiting the C

- 1100 Crude Unit A tmos pheric C olumn (Figure 4 )

. i A plot plan of
the crude unit sho ws the leak locat ion relative to C

- 1100 (Figure 5 ). As shown in Figure 6

, light gas oi l (the crude unit 4

- sidecut process fluid) exits the atmospheric column via a 20

- inch nozzle and is split into a 12

- inch line and an 8

- inch line. The August 6, 2012

, pipe rupture (Figure 7 )

oc curred on a 52

- inch long component ii of the 4

- sidecut 8

- inch line (the 52

- inch component ). The line operated at a temperature of 640 degrees F ahrenheit (°F) iii

i The atmospheric column separates crude oil feed into different streams through distillation. These streams are further processed in other units in the refinery. and had a n operating

p ressure of approximately 55 pounds per square inch gauge (psig) at the rupture location. At the

ii The term “component” refers to a portion of piping between welds or flanges. It includes st raight run piping and pipe fittings.
iii The auto

- ignition temperature for this process

, the temperature at which a material will combust in the presence of sufficient oxygen without an ignition source, was also 640 °F. This number is based on the Chevron Light Gas Oil Material Safety Data Sheet. Chemical testing of 4

- sidecut samples following the incident indicated lower auto

ignition temperatures; however, these samples may not have been representative of typical 4

- sidecut process fluid.Chevron R ichmond Refinery Interim Investigation Report April 2013

12 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD time of the incident

, l ight gas oil was flowing through t he 8

- inch line at a rate of approximately 10,800 barrels per day (bpd)

. i

Figure 4

. C

- 1100 Crude Unit Atmospheric Column and Upstream Process Equipment

.

i This is the equivalent of 315 gallons per minute (gpm). A barrel equals 42 gallons.Chevron R ichmond Refinery Interim Investigation Report April 2013

13 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 5 . Overhead view of the equipment in the #4 Crude Unit showing the leak location, commonly referred to as a plot plan.Chevron R ichmond Refinery Interim Investigation Report April 2013

14 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 6 . 4

- sidecut line configuration and rupture location

. 8

- inch
4

- sidecut line 12

- inch
4

- sidecut line

52

- inch component

Rupture
LocationChevron R ichmond Refinery Interim Investigation Report April 2013

15 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 4. The CSB com missioned Anamet, Inc.

, a m aterials e ngineering and l aboratory t esting company, to conduct testing of the 4

- sidecu t pipe, including the failed 52

- inch component

. The testing
concluded that the rupture was due to pipe wall thinning caused by sulfidation corrosion

, 3

5. Anamet’s metallurg ical analysis found that the 52

- inch component where the rupture occurred had experienced extreme thinning; the average wall thickness near the rupture location was approximately 40 percent thinner than a dime which
is discussed below

.

i ( the thinnest Am erican coin ). Between 1976 and
20 12, the 52

- inch piping component had lost , on average, 90 percent of its original wall
thickness in the area near the rupture

. The piping had an initial nominal wall thickness of 0.322

- inch ii when it was installed in 1976

.

Figure 7 . Photo of rupture on 4

- sidecut 52

- inch component

.

i The U.S. Mint reports that a dime has a thickness of 1.35 mm, or 0.053 inches. Information can be found at http://www.usmint.gov/about_the_mint/?action=coin_specifications (accessed February 14, 2013).
ii This portion of the 4

- sidecut line was constructed of 8

- inch Schedule 40 carbon steel piping.Chevron R ichmond Refinery Interim Investigation Report April 2013

16 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Sulfidation Corrosion

6. Sulfidation corrosion is a damage mechanism i that is well understood in the refining industry.
The sulfidation corrosion industry guidance document

, American Petroleum Institute ( API )
Recommended Practice (RP) 939

- C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries ii

[Sulfidation] ... is not a new phenomenon, but was first observed in the late 1800s in a pipe still (crude separation) unit, due to the naturally occurring sulfur compounds found in crude oil. When heated for separation, the various fractions in the crude were found to contain sulfur compounds that corroded the steel equipment. notes :

4

7. Sulfidation corrosion, also known as sulfidic corrosio n , 5 is a damage mechanism that causes thinning in iron

- containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F

. 6 This damage mechanism

causes pipe walls to gradually thin over time

. Sulfidation corrosion is common i n crude oil
distillation iii where naturally occurring sulfur and sulfur compounds found in crude oil feed , such as hydrogen sulfide

, iv

8. The reaction between sulfur and iron produces a layer of iron sulfide scale are available to react with steel piping and equipment

. Process variables
that affect corrosion rates include the total sulfur content of the oil, the sulfur species present, flow conditions, and the temperature of the system. Virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled

.

v on the inside surface of piping

. 7

i Piping da mage mechanisms are any type of deteriorati on encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspe ction Code: In

- Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3 rd ed., Section 3.1.1.5, November 2009. This reaction can be compared to that of oxygen and iron which also produces a
scale , commonly known as rust. The type of scale formed by sulfidation corrosion is dependent

up on the components contained in the steel

. Certain scales formed are protective and actually reduce the reaction rate between sulfur compounds and iron, minimizing sulfidation corrosion

ii API RP 939

- C is one of several relevant American Petroleum Institute recommended practices and standards under evaluation by the CSB as part of this investigation. To the casual observer API RP 939

- C appears to obligate the industry to take significant actions. However, the CSB concluded it was written to be permissive so that industry compliance with spec ific provisions would not be required. The complete findings from this evaluation will be included in the CSB’s Final Report.
iii Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013).
iv Hydrogen sulfide is the most aggr essive sulfur compound that causes sulfidation corrosion.

v Scale is a nonmetallic layer on the surface of metals and is often a result of corrosion.Chevron R ichmond Refinery Interim Investigation Report April 2013

17 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD rates. For instance, sulfidation corrosion affecting steel alloys containing greater than two weight percent (wt . %) chromium produces a protective scale that inhibit s the reaction between
the iron and sulfur compounds, thereby reducing corrosion rates. i With increasing percentages of chromium, the reaction is further slowed, greatly diminishing corrosion rates. 8

, ii For example,
stain less steel (an 18 wt. % chromium alloy) is nearly 15 times more resistant to sulfidation
corrosion t han 9

- C hrome (a 9 wt. % chromium alloy). 9 Conversely, s ulfidation corrosion rates are significantly higher in steels containing very l ittle chromium. Carbon steel, the Chevron 4

- sidecut line material of construction, wa s manufactured with a maximum concentration of 0.40
% chromium

. 10 The scal e formed on carbon steel is less protective and allows continued
reaction between the sulfur compounds and iron. 11

9. In addition to its inherently faster rate of sulfidation corrosion when compared with higher
chro mium steels, carbon steel also experiences significant variation in corrosion rates due to variances in silicon content, a compon ent used in the steel manufacturing process. Carbon steel piping containing silicon content less than 0.10 wt. % can corrode a t accelerated rates, Thus, carbon steel corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels.

12

i At greater than two wt. % chromium, sulfur compounds react with the steel to form FeCr 2 S 4 scale. This scale provides more protection than the FeS scale that forms on carbon steel piping. See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008

. u p to sixteen times faster than carbon steel piping containing higher percentages of silicon as shown in Figure 8

. This figure shows how carbon steel corrosion rates can greatly vary depending on
silicon content.

ii It has also been found that chromium “poisons” the decomposition of sulfur compounds to hydrogen sulfide which also slows down the sulfidation corrosion rate. See Couper, A.S. “High Temperature Mercaptan Corrosion of Steels.” 19 th Annual Conference of the National Association of Corrosion Engineers . Pages 396t

- 401t, New York: March 1963.Chevron R ichmond Refinery Interim Investigation Report April 2013

18 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 8 . This graph shows how corrosion rates increase in carbon steel containing decreasing percentages of silicon. This information can be found in Annex C of API RP 939

- C. i

10. The refining industry has been aware of increased rates of sulfidation corrosion in low

- silicon carbon steel piping since as early as 1974

, 13

Sulfidation corrosion has caused severe fires and fatalities in the refining
ind ustry, primarily because it causes corrosion over a relatively large area, so failures tend to involve ruptures or large leaks rather than pinhole leaks. It can be insidious in that moderately high corrosion rates can go undetected for years before failur e. Finally, process changes that increase the temperature or sulfur content can creep up over time and nearly 40 years before the August 6, 2012

, incident and two years before the Chevron crude unit was constructed. Prior to the incident, Chevron
d ocumented its understanding of the significant consequences of sulfidation corrosion. This is
reflected in Chevron’s Corrosion Prevention and Metallurgy Manual , which states :

i The y

- axis of this figure is in units of mils per year (mpy). A “mil” is 1/1000 inch. Silicon Content (Weight %)Chevron R ichmond Refinery Interim Investigation Report April 2013

19 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD multiply corrosion rates so that what was thought to be a low corrosion rate system becomes corrosive enough to fail before the increased
corrosion rate is recognized.

11. Carbon steel piping is manufactured to meet certain specifications

, including American Society for Testing and Materials (ASTM) A53B

, 14 ASTM A106

, 15 and API 5L

. 16 ASTM A53B and
API 5L do not contain minimum silicon content requirements for carbon steel piping, 17

12. In the mid 1980 s , pipe manufacturers be ga n to simultaneously comply with a ll three manufacturing specifications (ASTM A53B, ASTM A106, and API 5L) when manufacturing
carbon steel pip ing

. T he majority of carbon steel piping purchased following this time period likely has a minimum of 0.10 w t. % silicon content. However, piping purchased and installed prior to the mid

- 1980s could still contain low silicon components that are susceptible to high

, variable sulfidation corrosion rates. while ASTM A106 requires the piping to be manufactured with a minimum silicon content of 0.10

wt. %

. As a result, manufacturers have used diff erent levels of silicon in the carbon ste el pipe manufacturing process. Thus, depending on the manufacturing specification for carbon steel susceptible to sulfidation corrosion, corrosion rates could vary depending on the silicon content
within the steel.

13. Over 95 percent of the 144 refineries in operation in the U.S.

, including the Chevron Richmond Refinery

, i were built before 1985

, 18

14. The Chevron Richmond Refinery 4

- sidecut piping circuit containing the 52

- inch component that
failed was constructed of ASTM A53B carbon steel

, which had no minimum specification for
silicon content. Post

- incident t esting of samples of the 4

- sidecut piping from the Chevron Richmond Refinery identified silicon content ranging from 0.01 wt. % to 0. 2 wt. %

. Of twelve samples taken from the 8

- inch and 12

- inch 4

- sidecut line, six had a silicon concentration of less
than 0.10 wt. %

. The 52

- inch pipe component that ruptured on the day of the incident had a silicon content of only 0.01 wt. %

. The elbow component directly upstream of the 52

- inch component that failed had a silicon concentration of 0.16 wt. % and showed considerably less thinning ( Figure 9 )

. and thus before piping manufacturers began producing carbon steel in compliance with all three manufacturing specifications. Th erefore , the original carbon steel piping in these refineri es is likely to contain varying percentages of silicon content and may experience highly variable sulfidation corrosion rates

.

i The Chevron Richmond Refinery was constructed in 1902.Chevron R ichmond Refinery Interim Investigation Report April 2013

20 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 9 . 4

- sidecut piping sample (E

- 017

- 8) analyzed by Anamet Labs showing the relative thickness of low silicon piping on the left and the high silicon piping on the right. The ruptured pipe component (left) contained 0.01 % silicon and the upstream elbow component (right) contained 0.16 % silicon. 19 The initial n ominal thickness of this piping was 0.322

- inch.Chevron R ichmond Refinery Interim Investigation Report April 2013

21 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Sulfidation Corrosion Inspection Techniques

15. As evidenced by the chemical analysis performed on the Chevron 4

- sidecut piping post

- incident, carbon steel piping components within a single circuit i can contain varying percentages of silicon, resulting in a large variation in sulfidation corrosion rates by component. Historically, sulfidation corrosion monitoring techniques required the measurement of pipe thickness at only

a minimal number of perma nent Condition Monitoring Locations (CMLs) ii along the piping

. These CMLs are most frequently placed on elbows and fittings

. iii However, due to details of the manufacturing process, carbon steel pipe fittings generally contain high percentages of silicon. 20 When measurements are only taken at high

- silicon containing fittings, the measurements can fail to identify high corrosion rates within a pipe circuit caused by low

- silicon components. At the
Chevron Richmond R efinery, the 4

- sidecut piping had a total of 24 CMLs iv

16. Determining silicon content in existing carbon steel piping and equipment in the field i s a difficult undertaking. To properly characterize the silicon content in each component in a piping circuit, every component must be inspected. This is known as 100 percent component inspection. Two techniques are currently used to determine silicon c ontent in existing carbon steel piping circu i ts with unknown chemical composition : performing chemical analysis and pipe wall thickness measurements of every component

. on piping and fittings. The CSB found that there were no CMLs placed on the low silicon piping component
that failed. Chevron identified accelerated corrosion in the 52

- inch component in a 2002 inspection. However, no CML was added to ensure fu ture monitoring

, and the 52

- inch component was not inspected again. Instead, the CSB found that Chevron relied on inspection data gained primarily from high silicon pip e

- fitting components , such as elbow components. This inspection data did not reflect t he corrosion rate s of the lower

- silicon components of the 4

- sidecut piping

. Relying on the limited inspection data from the CMLs on the high silicon components, Chevron management denied multiple recommendations to replace the 4

- sidecut
line. As illustrated by the Chevron incident, inspection techniques alone may not accura tely identify the most aggressive corrosion rates throughout an entire c ircuit of carbon steel piping.
L ow

- silicon components can remain uninspected and unidentified until fail ures such as the August 6, 2012

, Chevron incident occur. As will be discussed below, upgrading metallurgy is a more effective means of managing sulfidation corrosion.

i A piping circuit is a length of pipe and the fittings associated with a particular process service that operate at similar conditions. A circuit usually begins and ends at either a branch or a piece of process equipment such as a vessel or a pump. Reference to piping by circuits allows piping to be grouped conveniently by proximity and operating service. Piping circuits may also be refe rred to as piping runs.
ii A condition monitoring location (CML) is a designated area where periodic thickness examinations are conducted. Each CML represents as many as four inspection locations located circumferentially around the pipe. CMLs are also ref erred to as thickness monitoring locations (TMLs) . CML was historically referred to as corrosion monitoring locations (CMLs) and that terminology is sometimes still used within the industry.
iii A fitting is a piping component usually associated with a ch ange in direction or diameter.
iv Many of these CMLs were added during the 2011 turnaround.Chevron R ichmond Refinery Interim Investigation Report April 2013

22 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 17. Many field

- portable instruments used for positive material identification cannot ade quately identify silicon content. 21 If original manufacturing quality assurance data i are not available, as
is generally the case with older plants, then chemical verification requires destructive testing. Metal shavings must be taken from each carbon stee l piping component for chemical analysis in a laboratory. 22

18. Carbon steel components containing low concentrations of silicon can also potentially be identified by performing thickness measurements of every component within a carbon steel
circuit. This method requires that the insulation be removed for access to the piping so that each individual piping component can be sampled and verified.

23 This practice is only useful if the piping circuit has been exposed to sulfidation corrosion for a long en ough time period so that variances in corrosion rate caused by di fferences in silicon content may be detected. Chemical analysis is therefore the most accurate technique to identify low

- silicon carbon steel components. As with chemical analysis, the thic kness measurement method requires that each individual piping component be identified by removing insulation (so every weld seam can be located), a time consuming and costly undertaking , or by using non

- destructive examination techniques. Thickness measur ements on hi gh temperature piping typically can only be done accurately and safely during unit turnarounds. ii

19. API Recommended Practice 939

- C Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries describes the challenges faced when attempting to thoroughly inspect carbon steel lines susceptible to sulfidation cor rosion. The recommended practice states that older ASTM A53 piping, such as the Chevron p iping that failed on August 6 th

, creates a “major inspection challenge” Although these various methods were available to detect the location of the field welds, Chevron had not
used them to identi fy the 4

- sidecut pipe segment locations.

24 and that “unless the refinery is fortunate enough to have located an inspection point on that particular [low silicon] section of pipe or fitting, it is very difficult to detect the thinning component.” 25 It states that in some applications, carbon steel will appear to be adequate based on measured corrosion rates until failure occurs at some undocumented or
unidentified low

- silicon component. 26

20. Unlike silicon concentration, the chromium concentration of steel can easily be verified in the field using portable positive material identification instruments. In addition, steel alloys containing a t least 9 wt. % chromium are more resistant to sulfidation corrosion and do not run the risk of extreme variations in corrosion rates within components in the same piping circuit. iii

i Manufacturing quality assurance data, also known as mill data, provides the chemical composition of the steel. This makes alloys with higher chromium content an inherently safer choice i n high temperature

ii A “turnaround” is a scheduled shutdown of a pr ocess unit to perform maintenance, repairs, upgrades, and inspection of process equipment.
iii The protective scale, FeCr 2 S 4 , begins to be the dominant scale formed in steels containing a chromium content of five wt. % . The 5Cr steel alloy can be manufact ured to contain anywhere from 4% to 6% chromium. Thus, “the sulfidation corrosion rate can vary dramatically in 5Cr steels even in the same operating environment.” See Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperatu re Sulfidation Corrosion in Refining." 17th International Corrosion Congress. Las Vegas: NACE International, 2008.Chevron R ichmond Refinery Interim Investigation Report April 2013

23 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD sulfidation corrosion environments

. i As shown in the Mo dified McConomy Curves ii from API
RP 939

- C (Figure 10)

, 9

- Chrome iii corrodes 15 times faster than stainless steel

, iv and carbon
steel v corrodes 125 times faster than stainless steel. 27

Figure 10 . Modified McConomy Curves from API RP 939

- C

.

i Steels with higher chromium content are inherently safer than carbon steel with respect to sulfidation corrosion. However, analysis is stil l required to ensure that the best material of construction is selected.
ii Modified McConomy Curves are the set of curves API RP 939

- C uses to predict sulfidation corrosion rates versus temperature for several steel alloys.
iii 9

- Chrome contains 9 wt. % chromium.
iv Stainless steel contains 18 wt. % chromium.

v ASTM A53B carbon steel contains a maximum of 0.40 wt. % chromium. 100.0Chevron R ichmond Refinery Interim Investigation Report April 2013

24 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Chevron Sulfidation Corrosion Knowledge and Expertise

21. Figure 1 1 shows a timeline of Chevron’s key sulfidation events. Chevron technical staff has considerable knowledge and expertise regarding sulfidation corrosion , specifically with respect to
corrosion rate variations cau sed by differing silicon concentration in carbon steel piping

. Chevron employees have authored industry pap ers on sulfidation corrosion and had significant influence in the development of the industry sulfidation corrosion recommended practice , API RP 939

- C

. This recommended practice , first published in 2009, was developed under Chevron leadership. At the approximate time of publication of API RP 939

- C, Chevron Energy Technology Company (Chevron ETC) i created an internal document on the sub ject of sulfidation corrosion. Chevron
ETC metallurgists released a formal report dated September 30, 2009 (ne arly 3 years prior to the incident) to Chevron refinery

- based reliability managers and chief inspectors en titled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries

.

Figure 11 . Chev ron’s key sulfidation events between 1974 and 2013.

i The Chevron Energy Technology Company is a separate business unit within the Chevron C orporation that provides technology solution s and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013)Chevron R ichmond Refinery Interim Investigation Report April 2013

25 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD

22. Sulfid ation experts acknowledged in the Chevron ETC report that, “Until now, Chevron has not directly addressed the risk of low Si[licon] carbon steel...” i

Sulfidation corrosion failures are not common in Chevron or in the industry but they are of great concern because of the comparatively high likelihood of blowout or catastrophic failure [...] . This can happen because corrosion occurs at a relatively uniform rate over a broad area so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition the process fluid is often
above its auto ignition temperature. The combination of these factors means that sulfidation corrosion failures frequently result in large fires. [...] [S]everal case histories of sulfidation corrosion failures that have occurred in Chevron or in the industry several of which are blowouts. and that the report lays out a program that “seek s to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic failure from sulfidation corrosion and ca lls out Chevron’s need for action:

This Chevron ETC report specifically recommends that inspectors perform 100 percent component inspection o n high temperature carbon steel piping susceptible to sulfidation corrosion

. However, this 100 percent component inspection progr am was not implemented at the Richmond refinery prior to the August 6, 2012 incident. The Chevron ETC report defines a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4

- sidecut stream placed it i n the highest priority for inspection.

23. Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the potential consequence of sulfidation failures

. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the
crude unit 4

- sidecut piping. The newsletter states:

Sulfidation corrosion failures

... are of great concern because of the comparatively high likelihood of “blowout” or catastrophic failure

. T his typically happens because corrosion occurs at a relatively uniform rate
over a broad area

, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area

. In addition

, the

proces s fluid is often above its auto ignition temperature

. The
combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents
have reinforced the need for revised inspection strategies and a robust
PMI ( Positive Materials Identification ) program

.

i A 2003 corporate technical newsl etter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident.Chevron R ichmond Refinery Interim Investigation Report April 2013

26 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD The Chevron ETC 100 percent component inspection recommendation for high risk piping systems

, established in 2009, was not implemented at R ichmond; therefore, the thin

- walled low silicon 4

- sidecut piping component remained in service until it cata strophically failed on August 6, 2012

.

24. Chevron and Chevron ETC metallurgists , materials engineers, and piping inspectors had expertise regarding sul fidation corrosion. They educated personnel and advocated for identification and
control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. T hese individuals did not p articipate in
the crude unit Process Hazard Analysis ( PHA ) i and did not affect decisions concerning control of sulfidation corrosion during the crude unit turna round process

. ii

i A process hazard analysis is a hazard evaluation to identify, evaluate, and control the hazards involved in a process. Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the California Code of Regulations Title 8 Se ction 5189. Process Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental Release Preventi on Program and the federal EPA Risk Management Program.
ii The turnaround process includes both the planning s tage prior to the shutdown and the activities staged during the shutdown.Chevron R ichmond Refinery Interim Investigation Report April 2013

27 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Other Significant Sulfidation Occurrences

25. The refining industry has experienced numerous sulfidation corrosion failures, primarily in piping. 28 API RP 939

- C identifies 45 sulfidation corrosion failures, one third of which were found to have occurred in carbon steel piping containing low levels of silicon. 29

26. The August 6, 2 012

, Chevron Richmond R efinery 4

- sidecut pipe rupture was not the first
sulfidation corrosion

- related incident to occur at a Chevron refinery. In 1988, a low silicon carbon steel (0.02 wt. % silicon) piping component failed at the Chevron ’s former El Paso Refinery i

27. In 2002, the Chevron Salt Lake Cit y R efinery experienced a fire when process piping failed as a result of sulfidation corrosion in a low silicon ASTM A53 carbon steel piping component. Chevron communicated the incident throughout the company in a technical newsletter. Chevron experts found that despite regular monitoring of the line for 30 years in compliance with industry standards, their inspection program failed to prevent the failure. Corrosion rates at the unmonitored failure location were found to be five times greater than corr osion rates at the

mo nitored piping locations. The monitored locations were constructed of high silico n ASTM A106 piping (Figure 1 2 ). Chevron also found that in the years preceding the failure, both the temperature in El Paso

, Texas

. In addition, two sulfidation corrosion incidents occurred at the Chevron Pascagoula refinery in Pascagoula, Mississippi : one in 1993 and one in 1988 on a low

silicon carbon steel component.

ii

i The El Paso Refinery is now owned by Western Refining. and hydrogen sulfide concentration in the process had been increasing. Each of
these factors increased corrosion rates and contributed to the failure. In 2003, following this incident, Chevron experts recommended that refineries inspect every piping component (100 % component inspection) in all high

- risk piping systems: those operati ng above 550 ° F and containing hydrogen sulfide.

ii The temperature in the line had been increased by over 170 °F throughout the life of the unit. During the two years prior to failure, temperatures of the line exceeded the measurement capabilities of the temperature measurement device and so the actual temperature increase cannot be determined.Chevron R ichmond Refinery Interim Investigation Report April 2013

28 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 12 . Schematic of failed piping from the Chevron Salt Lake Refinery. Similar to the Chevron Richmond Refinery incident, the failed piping contained low amounts of silicon and corroded significantly faster than adjacent piping components

.

28. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron
Richmond R efinery crude unit resulting in a CWS Level 3 alert

, initiating a shelter

- in

- place for the surrounding community

. A carbon steel piping spool i failed catastroph ically during operation (Figure 13 )

. The carbon steel piping contained a low percentage of silicon (<0.005

wt. % )

. The process fluid ignited, injuring a nearby worker

. Chevron informed Contra Costa Health Services’ Hazardous Materials Program ii

i A piping spool is a small, removable section of piping. In some cases, a pip ing spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits. ( Contra Costa County ) in a letter that the metallurgy had been upgraded following this incident as an inherently safer sol ution. However, the CSB learned that this upgrade was limited to only the immediate piping spool that failed.
The inherently safer, more corrosion resistant metallurgy was not implemented more broadly in crude unit high temperat u re service as a result of this incident

.

ii Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor hazardous mate rials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

29 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 13 . Failed piping component that resulted in the 2007 Richmond crude unit fire. This carbon steel piping was found to contain less than 0.005 percent silicon.

29. Following the August 6, 2012

, incident, personnel at the Chevron El Segundo, C alifornia

, refinery, a near duplicate of the Richmond refinery, inspected their refinery’s crude unit 4

- sidecut piping. Significant thinning was discovered in the line; the piping from the atmospheric
crude column to the pumps was removed and substituted with 9

- Chrome, an upgraded and inherently safer material of constructi on

.

30. On November 9, 2009, the Silver Eagle refinery in Woods Cross, Utah, experienced a catastrophic piping failure due to sulfidat ion co rrosion in a 10

- inch pipe, while conducting a temporary operation at higher than normal operating temperature

. The pipe was located on theChevron R ichmond Refinery Interim Investigation Report April 2013

30 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD bottom of a reactor in the de

- waxing unit. The failed pipe released hydrogen which subsequently exploded, damaging over 100 homes in the nearby neighborhood.

31. On October 6, 2011, an explosion and fire resulted from a catastrophic piping failure at a Canadian refinery in Regina , Saskatchewan

, injuring 52 workers. The piping component that failed was substantially thinn er than neighboring components. Prior to the incident, the company’s inspection data indicated that wall thickness in the overall piping system was within acceptable limits. However, the specific component that failed was not inspected. Although
Canadia n authorities are still investigating, metallurgical testing has indicated that hydrogen
sulfide corrosion contribut ed to the catastrophic failure.

32. In February 2012, the BP refinery crude unit in Cherry Point, Washington, suffered a failure due to sulfidation corrosion, causing a large fire. This incident demonstrates that even when applying inherently safer concepts to reduce the potential for major hazards, it is still vital to fully understand all processes and piping configurations and incorporate a rigorous inspection

program. The piping that failed was constructed of 9

- Chrome. The line was used only during

start

- up operations and otherwise remained in

- service and non

- flowing. Such lines that do not have regular process flow yet remain in contact with process fluids are commonly referre d to as “dead legs.” The failure location was a high

- point in the piping connected to the top of an operating process line. Hydrogen sulfide evolved from the process fluid and collected in the 9

- Chrome piping. The concentrated vapor

- phase hydrogen sulfi de severely corroded the 9

- Chrome, causing the failure. CMLs were located on adjacent elbow components; however, no CMLs were placed on the straight

- run piping component where the failure occurred. The Cherry
Point sulfidation failure demonstrates that e ven with more corrosion

- resistant, inherently safer metallurgy, failure from sulfidation corrosion still may occur if piping is not effectively inspected or piping configurations are not adequately evaluated. In addition it is important to
conduct a thoro ugh analysis to determine the best material of construction for the process
conditions

.Chevron R ichmond Refinery Interim Investigation Report April 2013

31 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Process Hazard Analysis

33. Chevron personnel analyze numerous deviations i

34. Sometimes referred to as a corrosion review, a damage mechanism hazard review analyzes risks presented by all process failure mechanisms such as corrosion and cracking. Common process
failure mechanisms are described in API 571: Damage Mechanisms Affecting Fixed Equipment in the Refining and Petrochemical Industries

. for each portion of a process when conducting a Process Hazard Analysis (PHA)

. These include co nditions such as changes in flow and temperature and pressure extremes. Specificall y of interest, one of the deviations analyzed was “leak/rupture” of the particular vessel or pipe

. For each deviation , the team ’s responsibility was

to identify causes, co nsequences, safeguards, and recommendations. The 4

- sidecut line was

a nalyzed in the most recent c rude u nit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added)

.

30 Such a review ensures that potential hazards caused by process conditions, process materials, and external mechanisms are properly identified, analyzed, and systems are put in place to contro l or eliminate the hazard. Despite Chevron knowledge and expertise of potential damage mechanisms (such as sulfidation corrosion), t he CSB found these hazards are only identified in a PHA if the participants conducting the PHA happen to have personal know ledge of the relevant mechanism. T he
Chevron PHA team s do not typically seek assistance from corrosion experts. ii The inclusion of a damage mechanism hazard review as part of the PHA is not required by the state of California

, the California Division of Occupational Safety and Health (Cal/OSHA), iii Contra Costa County

, the C ity of Richmond, iv

i Deviations using guide words (such as no, more, less, as well as) and process parameters (such as flow, pressure, temperature) are analyzed in PHAs. See Center for Chemical Process Safety (CCPS). “Guidelines for Hazard Evaluation Procedures.” 2 nd ed., Page 132, 1992. or Chevron standards. Because Chevron does not conduct, and is not required to conduct, a formal damage mechanism hazard review, damage mec hanisms are only
identified when the PHA team happens to have some knowledge of the mechanism . As a result, many damage mechanisms which occur in various processes are not properly addressed.

ii The Crude Unit Business Improvement Network (BIN) Leader, a crude unit expert, reviews portions of the PHA with the PHA team. However, this review did not identify the potential for sulfidation corrosion failures in the 4

- sidecut piping. A rigorous review of corrosion and damage mechanisms present in the crude unit was not performed during the PHA process.
iii The state of California, under an agreement with the federal Occupational Safety and Health Administration, or OSHA, operates an o ccupational safety and health program in accordance with Section 18 of the Occupational Safety and Health Act of 1970. See http://www.osha.gov/dcsp/osp/stateprogs/california.html (acces sed April 17, 2013). The Department of Industrial Relations administers the California Occupational Safety and Health Program, commonly referred to as Cal/OSHA. The program applies to all public and private sector places of employment in the state, with some exceptions. See http://www.dir.ca.gov/dosh/dosh1.html (accessed April 17, 2013).
iv The City of Richmond adopted an ordinance on Industrial Safety, Richmond Municipal Code Chapter 6.43 (also known as the RISO), on December 18, 2001, “for the purposes of protecting public health and safety by prevention of accidental release of hazardous materials and to assure protection of the environment.” Richmond Municipal Code §6.43.040 (February 5, 2013). There are two facilities, including Chevron, that are located in the City of Richmond and subject to this ordinance. More information about the RISO is provided later in the report.Chevron R ichmond Refinery Interim Investigation Report April 2013

32 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 35. During a hazard analysis process such as a PHA, the evaluati on team has to determine the likelihood of a hazardous consequence occurring. Then the team must identify safeguards which
will reduce the risk of the hazard to an acceptable level. A recognized methodology for consistently and objectively making these d eterminations could inc lude the use of quantitative,
semi

- quantitative , or qualitative tools

. 31 Chevron does not employ a prescribed methodology for determining the likelihood that an incident will occur or whether a safeguard will be effective. Instead, Chev ron relies upon the judgment of the people on the PHA team , who base their conclusions up on the ir collective experience s, beliefs

, and areas of expertise

. In its 2009 crude unit PHA, Chevron simply cite d non

- specific, judgment

- based qualitative safeguards such as: utilizing m etallurgy to minimize corrosion, having effective main tenance and inspection

programs, and providing pipe wall corrosion allowances

. i

36. Following the August 6 th incident, Cal/OSHA inspected the Chevron facility and issued
citations. Only one citation related to PHAs , and it was not associated with evaluating the effectiveness of safeguards. Rather, t he emphasis was that Chevron’s PHA did not adequately

account for hazards caused by other units associated with the c rude u nit. The citation stated “The Employer [Chevron] failed to perform an effective Process Hazard Analysis [PHA] of the

c rude u nit. Specifically, it failed to identify, evaluate

, and control poten tial hazards caused by upstream and downstream units that provide and receive feed from the c rude u nit.” The effectiveness of these safeguards

was n either evaluated nor documented; instead the sa feguards were merely listed in the PHA.
Had the adequacy of these safeguards been verified , improved safeguards intended to protect against sulfidation

- induced failure of carbon steel piping could have been recommended

.

32

i C orrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment beyond that needed solely for mechanical considerations such as design temperature and pressure. Th is extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment. Had the
Cal/OSHA regulation required documentation of the effectiveness of safeguards , Chevron would have been obligated to conduct this analysis and Cal/OSHA inspectors could rely on the regulation fo r support during inspections.Chevron R ichmond Refinery Interim Investigation Report April 2013

33 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Operational Changes

37. The original design of the 4

- sidecut circuit included equipment which had the effect of removing dissolved hydrogen sulfide, the most aggressive sulfur compound associated with sulfidation corrosion, from the 4

- sidecut light gas oil process fluid. As a result, the 4

- sidecut equipment was effective in reducing the sulfidation corrosion rate. This allowed the 4

- sidecut equipment to
be constructed of carbo n steel. In 1991

, this 4

- sidecut equipment was taken out of service. No management of change i

38. Crude oil feedstock used at the Chevron Richmond R efinery is obtained from a variety of
different sources that are blended b efore processing. These various crudes have different compositions, such as varying sulfur comp ounds and concentrations. These crudes can have differing corrosion effects on process equipment and piping. There is an increasing trend in
crude oil refinin g to process less expensive “opportunity crudes” because they can provide significant cost savings to the company. (MOC) was performed to analyze the effect of the elimination of this hydrogen sulfide

- removing equipment on 4

- sidecut corrosion rate s

. Such an MOC would have

e nsure d that the increase in sulfur concentration on the carbon steel 4

- sidecut piping was reviewed prior to removing the equipment.

ii However, these crudes may contain more undesirable characteristics such as high sulfur content, high naphthenic acid content, or very heavy hydrocarbons 33

i Management of change requires that employers have procedures to manage changes to process chemicals, technology, equipment, and procedures. The procedures must address the technical basis for the change, the impact on safety and health, and training required for employees affected by the change. that a refinery may not have been originally designed to process. Refinery equipment may not be the proper material of construction to achieve the design life of the equipment when exposed to the different operating conditions

. Additional mitigation may be
needed to reduce risk. In 1984, the Chevron Richmond Refinery crude oil feed co ntained approximately 8 5 volume % Alaskan North Slope (1 wt. %) crude oil. As the refinery began running more high

- sulfur content crudes, the sulfur content in the 4

- sidecut line steadily
increased (Figure 14) , as discussed below

.

ii Crude oil costs can account for up to 90% of the operating costs in a refinery. See Qu, Dingrong, Xiaohui Liu, Xiu Jiang, Zhenggui Lan, and Guangbin Shan. “Setting Critical Operational TAN and Sulfur Level for Crude Distillation Units.” Corrosion 2011 Conference & Expo. Paper No. 11362. NACE International, 2011.Chevron R ichmond Refinery Interim Investigation Report April 2013

34 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Figure 14 . Graph shows the percentage increase from 1984 values of the sulfur content in the 4

- sidecut.

39. When Chevron introduces a new crud e, an MOC is generated to evaluate the potential impact on the refinery

. i

40. The CSB found that increase d Chevron Richmond usage of non

- domestic crude feed stock over
time resulted in h igher sulfur content in the process fluid passing through the 4

- sidecut piping

. Specifically, the percentage of sulfur in the Richmond r efinery crudes increased nearly 85 % between 1984 and 2012, including a significant jump of 32 % from 1998 to 1999

. This increase in sulfur content correspond ed with a simultaneous increase in the usage of non

- domestic crude
feed at the Richmond refinery

. While Chevron stayed under its established crude unit design basis for total wt. %
sulfur of the blended feed to the crude unit, the sulfur composition significantly increased over
time

. Historic data indicates that the sulfur in the 4

- sidecut stream has increased from 0.8 to 1.6
wt%. This increase in sulfur composition likely increased corrosion rates in the 4

- sidecut line

. Chevron did not conduct an MOC analyzing the impact that increases in sulfur composition
would have on corrosion in the crude unit. Chevron also did not change its corrosion monitoring programs in response to the increased sulfur content.

i Chevron MOCs on new crudes considered general operational issues but did not analyze corrosion effects from sulfidation corrosion.Chevron R ichmond Refinery Interim Investigation Report April 2013

35 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 41. Sulfidation corrosion rates increase in piping circuits as temperature and sulfur content increase

. Accordingly, the 4

- sidecut sulfidation corrosion rate increased between 1984 and 2012 due to
the increase in sulfur content in the line. T he CSB found that for the 26

- year period from the
installation of the piping in 1976 through 2002

, the 52

- inch 4

- sidecut component had lost approximately 33 percent of its wall thickness. From the single inspection of the 52

- inch component in 2002 to the incident in 2012

– j ust ten years

– an additional 57 percent of the original component nominal wall thickness was lost near the rupture location due to sulfidation
corrosion. i

42. API RP 939

- C states that refinery feed stock changes reduce the relevance of past inspection data when predicting future corrosion rates: In addition to the sulfur content increase

, the 4

- sidecut draw temperature increased
from 625 °F in 1992 to 680 °F in 2002

. Corrosion rat es and remaining life calculations based on past sulfur content and temperatures may not accurately reflect current corrosion rates if process conditions have changed. I nspection based on historical corrosion rates may be too infrequent to
detect a n incre ase in corrosion caused by adverse changes in process conditions , potentially leading to equipment failure.

Oil refi neries that processed a consistent diet of a particular crude oil or crude blend could often base future predictions on past experience. However, over the past 20+ years, global economics have resulted in many refineries processing tens of different crudes in any given year ; thus, minimizing the accuracy, or even feasibility, of predictions based
on historical data. Additionally, the verification of the actual corrosion rate experienced while processing a specific crude oil is very difficult. 34

43. AP I 570 Piping Inspection Code: In

- service Inspection, Rating, Repair, and Alteration of Piping Systems , t h e API standard for inspecting piping, r ecommends companies to incorporate process changes into inspection programs. The standard states:

The owner/user is ... responsible for implementing an effective MOC process that will review and control changes to the process and to the
hardware. An effective MOC process is vital to the success of any piping integrity management program in order that the inspection group will be able to anticipate changes in corrosion or other deterioration variables and alter the inspection plan to account for those changes. The MOC process shall include the appropriate materials/corrosion experience and expertise in order to effectivel y forecast what changes might affect piping integrity. The inspection group shall be involved in the approval process for changes that may affect piping integrity

.

i The 4

- sidecut 52

- inch component had an original wall thickness of 0.322 inches. Metallurgical analysis found the thinne st portion of the 52

- inch 4

- sidecut component was 0.03 inches.Chevron R ichmond Refinery Interim Investigation Report April 2013

36 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Changes to the hardware and the process shall be included in the MOC process to ensure its effectiveness [emphasis added]

. 35

Chevron failed to comply with the requirements of API 570 when it did not conduct an
MOC to thoroughly evaluate the change of increasing sulfur weight percentage in crude
oil feed and to assess how it might affect corrosion rates within the 4

- sidecut piping
circuit. After the August 6, 2012 , incident, Cal/OSHA inspected the Chevron Richmond Refinery and issued citations. i



## Chevron Sulfidation Corrosion Inspection and Mitigation However, Cal/OSHA did not issue any citations for failing to perform an MOC when sulfur composition in the cr ude oil feed
was increased.

44. In the ten years prior to the incident

, a small number of Chevron personnel with knowledge and understanding of sulfidation corrosion made at le ast six recommendations (listed in the following six paragraphs and included in Figure 1 5 ) to increase inspection s or upgrade the metallurgy in the 4

- sidecut piping

. The recommendations made by these personnel were not implemented by Chevron management

.

Figure 15 . Key events at the Richmond refinery between 1998 and 2013.

i Cal/OSHA citations issued January 30, 2013.Chevron R ichmond Refinery Interim Investigation Report April 2013

37 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 45. In August 2002, a Chevron Richmond R efinery employee performed a study analyzing
sulfi dation corrosion rates in the crude u nit and identifying potentially vulnerable areas

. The employee discovered that the 4

- sidecut operating temperature had been increased and concluded
that this increase would cause more hydrogen sulfide to evolve

, leading to increased sulfidation
corrosion rates. As a result of these findings, the employee recommend ed increased inspection
of the 4

- sidecut piping and noted that this piping might need to be upgraded from carbon steel to
5

- Chrome , a steel alloy that is more resistant to sulfidation corrosion. In 2002, proactive ly following up on this study, the crude unit inspector conducted additional piping inspection and
identified accelerated corrosion in the 52

- inch 4

- sidecut component. The inspector recommended upgrading this piping during the next shutdown in 2007

. In t he inspector’s 2002 accomplishments, Chevron management acknowledged this effort to prevent a significant incident; i t was characterized as “a save.” However, during the 2007 turnaround the
recommendation was not implemented

, and because a CML was not added to the inspection

program , the 52

- inch co mponent was not inspected after 2002

.

46. In February 2006, a team consisting of a materials and corrosion engineer, an inspector, a process engineer, a metallurgist, and a design engineer issued a Cor rosion Mitig ation Plan for
the Chevron Richmond Refinery c rude u nit

. The repor t specifically identified the 4

- sidecut piping to be at risk for high temperature sulfidation corrosion. The report described that low
silicon carbon steel can corrode faster than carbon s teel manufactured with higher silicon content, and recommended that 100 percent i nspection be performed on the 4

- sidecut line using continuous monitoring technology. During the 2007 c rude u nit turnaround, continuous monitoring probes were only installed o n a segment of the 4

- sidecut line that did not include the
52

- inch compon ent that ultimately failed. The 100 percent inspection recommended in the 2006 Corrosion Mitigation Plan was not performed

.

47. During the 2007 turnaround, the crude unit inspector recom mended that the refinery upgrade the
entire 4

- sidecut piping with 5

- Chrome. The recommendation was based on findings obtained during the 2002 crude unit turnaround, where the crude unit inspector found that the 52

- inch 4

- sidecut component had lost one

- third of its wall thickness due to corrosion. However, after evaluation, t his recommendation was not accepted by the turnaround planning team. Basing its decision on limited inspection dat a, Chevron determined tha t the 8

- inch portion of the 4

- sidecut piping that ran from the atmospheri c column to the pump , the portion which include d the 52

- inch component

, had sufficient wall thickness to last to the n ext turnaround scheduled for Fall
20 11

. i

i This decision was made without reinspecting or evaluating the thickness of the thinned 52

- inch component identified in 2002 that prompted the r ecommendation. T he piping downstream of the pump , which operates at a highe r pressure, was determined not to have sufficient wall thickness to l ast to the next turnaround. T his piping was removed and replaced with 9

- Chrome, an upgraded and inherently safer metallurgy

. T he 52

- inch component of the 8

- inch piping between the atmospheric column and the pump was not replaced during the 2007 turnaround even though it had been identified as thinned in 2002

.Chevron R ichmond Refinery Interim Investigation Report April 2013

38 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Furthermore, a permanent CML was not placed on the 52

- inch component

, and it was not

entere d into the inspection database

. As a result, the component was not inspected again.

48. In September 2009, Chevron ETC corrosion experts released a formal technical report discussing sulfidation corrosion and the specific issues associated with carbon steel, including the potential for high corrosion rates in carbon steel piping containing low percentages of
silicon. In its report , Chevron ETC issued recommendations for inspection and provided guidelines for prioritizing piping circuits susceptible to sul fida tion corrosion so that high

- risk
lines could be evaluated first. It was recommended that 100 percent component thickness testing be completed on all high priority lines one time to identify thin, low

- silicon components to
establish a baseline of corrosion rate and risk for failure. Following the release of the report , the
Chevron Richmond Refinery materials group completed the risk

- ranking of the carbon steel piping in the Richmond Lube Oil Project (RLOP) and in the crude u nit

, two units known to be

susce ptible to su lfidation corrosion. The group identified the crude unit 4

- side cut line as a high
risk line per the report ranking guidance

. Instead of completing the 100 percent component inspection, the 4

- sidecut was recommended for replacement with 9

- Chrome. However, the replacement recommendation was denied because the available, limited inspection data indicated the piping would last unti l the next turnaround. Subsequently, the alternative 100 percent component inspection was also never performed.

49. Five months prior to the incident i n March 2012, a Chevron corporate review of Richmond identified that inspection of all carbon steel compone nts susceptible to sulfidation corrosion was not being performed at the Richmond refinery. In addition to identifying that CMLs were not in the proper locations, t his corporate review found that critical inspection recommendations were being submitted to the shutdown planning process, but were being denied. Chevron corporate identified that Richmond refinery leadership needed to review and implement the 2009 Chevron ETC report recommendations.

50. Chevron conducts “Intensive Process Reviews” prior to turnaro unds. This process involves knowledgeable individuals including Business Improvement Network leaders, process engineers, metallurgical engineers, design engineers, and turnaround planners. The purpose of the review is to identify key unit issues that sho uld be addressed and repair ed during the unit turnaround. Prior to the 2011 crude unit turnaround, Chevron personnel conducted a n I ntensive P r ocess Review of the crude unit and specifically recommended that the 4

- sidecut carbon steel piping “s hould be

upg raded to 5 Cr [5

- Chrome]... due to sulfidation.” Although the I ntensive P rocess Review
identified sulfidation problems in the 4

- sidecut line, this activity was in effective. The 4

- sidecut piping was not upgraded during the 2011 crude unit turnaround.

51. In preparation of the work list for the 2011 crude unit turnaround, the crude unit inspector and crude unit metallurgist recommended that the 4

- sidecut line be replaced with an upgraded metallurgy, 9

- chrome, the metallurgy recommended in the Chevron new const ruction guidelines for piping in high temperature and high sulfur service. The recommendation was based on theChevron R ichmond Refinery Interim Investigation Report April 2013

39 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD high priority ranking of the 4

- sidecut line, corrosion history, and both Chevron and industry
recommended best practice

. However, the turnaroun d management team determined that t he inspection data available for the 4

- sidecut piping, from CMLs on elbow c omponents which a re less prone to sulfidation corrosion, did not support a material upgrade during the 2011
turnaround

. i

, ii

i This decision was made without reinspecting or evaluating the thickness of the 52

- inch component identified in 2002. The lack of data on t he more susceptible 4

- sidecut straight

- run piping component s
was not con sidered.

ii A portion of the 4

- sidecut 12

- inch line was replaced during the 2011 turnaround with carbon steel due to thinning

caus ed by sulfidation corrosion.Chevron R ichmond Refinery Interim Investigation Report April 2013

40 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Inherently Safer Systems

52. The Center for Chemical Process Safety (CCPS) is a corporate membership organization that identifies and addresses process safety needs within the ch emical, pharmaceutical, and petroleum industries. 36 Chevron is a corporate member of CCPS. 37 The CCPS book Inherently
Safer Chemical Processes , 2 nd ed. defines inherently safer design as the process of identifying and implementing inherent safety in a specific context that is permanent and inseparable. 38 In
the book Guidelines for Engineering Design for Process Safety, 2 nd ed

. , CCPS states “inherently safer design solutions eliminate or mitigate the hazard by using materials and process conditions
that are less hazardous. ” 39

53. Inherently safer technologies are relative; a technology can only be described as inherently safer
when compared to a different technology with regard to a specific hazard or risk. 40 A technology may be inherently safer with respect t o one risk but not safer from another risk. For
this reason

, it is important to carry out a comprehensive, documented hazard analysis to determine the individual and overall risks in a process and assess how the risk s can be effectively minimized to contr ol hazards

. An inherently safer systems review details a list of choices offering various degrees of inherently safer implementation. Th e review should include
risks of personal injury, environmental harm, and lost production , as well as evaluating economic feasibility. 41

54. It is simpler, less expensive , and more effective to introduce i nherently safer features during the design process of a facility rather than after the process is already operating

. 42

55. After a 2007 incident caused by a pipe failure in the Richmond refinery crude unit, Chevron implement ed an “Inherently Safer Solution” by upgrading the piping to metallurgy that was less susceptible to sulfidation corrosion. However, the change was implemented intuiti vely without a supporting inherent safety review or failure mechanism hazard review to provide a detailed documented technical rationale for the metallurgy selection. Without such a review, the material selected cannot be analyzed to determine if it is th e best inherently safer solution for the process
in order to minimize risk. Process upgrades, rebuilds, and repairs are addit ional opportunities to implement inherent safety concepts. Conducting a comprehensive hazard review to determine risks and identify ways to eliminate or
reduce risk s is an important step in implementing an inherently safer process

. Chevron training

progr ams on inherently safer systems reflect this approach, stating “we have the greatest opportunity to eliminate or minimize hazards during the development phase of new projects or major revamps of existing facilities

. ”Chevron R ichmond Refinery Interim Investigation Report April 2013

41 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 56. Following the August 6, 2012

, incident, the 4

- sidecut piping circuit at the Richmond refinery was upgraded from carbon steel to 9

- Chrome

. i However, Chevron did not produce a
d ocumented inherently safer hazard review before commencing the rebuild of the crude unit.
The crude unit at the Chevron El Segundo refinery is nearly identical in construction and design
to the Richmond refinery crude unit. Chevron informed the CSB that p iping downstream of the
4

- sidecut pumps in the 4

- sidecut piping circuit at the El Segundo refinery w as upgraded in 200 1 ii

57. An effectiveness rankin g of techniques used to control hazards and the risk they repre sent can be described as a hierarchy of controls. The further up the hierarchy, the more effective the risk
reduction achieved (Figure 1 6 )

. All concepts in the hierarchy of controls should be included in the process of risk assessment and reduction. Upgrading metallurgy to a more corrosion resistant material may be a high ranking, inherently safer choice for certain corrosion mechanisms, such as sulfidation corrosion. Holding other variables constant, upgrading the material of construction may reduce the severity of corrosion and the likelihood of a failure. from carbon steel to stainless steel

. As stated previously, after the August 6, 2012, Richmond incident, the 4

- sidecut piping upstream of the 4

- sidecut pumps at the El Segundo refinery was upgraded from carbon steel to 9

- Chrome. Had a comprehensive inherently safer systems review
been conducted at the Richmond refinery following the August 6 th incident, a different metallurgy, such as s tainless steel which was installed at the Chevron El Segundo Refinery, may have been identified as inherently safer than 9

- Chrome with respect to sulfidation corrosion.

Figure 16 . Hierarchy of controls. The boxes reflect inherently safer controls from left to right , based on **Process Plants: A Handbook for Inherently Safer Design Second Edition**  ; Kletz, Trevor Amyotte, Paul; CRC Press 2010.

58. Chevron employees have recommended implementing inherently safer designs through the MOC process , incident investigations

, technical reports, and recommendat ions from employees in the past. However, the CSB has not identified any documented, thorough analysis of the

propo sed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. For exa mple, f ollowing the discovery of significant
4

- sidecut piping sulfidation corrosion in 2002, a Chevron inspector issued the following recommendation to replace the piping in the 2007 t urnaround:

i After the 2012 incident, the Richmond refinery stated that stainless steel was susceptible to chloride stress corrosion cracking and should not be used.
ii Chevron verbal estimate for date of piping installation. No MOC was co nducted to review and document this change.Chevron R ichmond Refinery Interim Investigation Report April 2013

42 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD The #4 sidecut piping from C

- 1100 to P

- 1149/A to E

- 1113 was RT (x

ray) inspected for hot H2S [sulfidation] corrosion. The piping is actively corroding, particularly on the section on the discharge line from the pumps near the exchanger; the line upstream of the P

- 1149/A pumps is corroding as well. Corrosion rates indicate that the piping has 4 years of remaining life until the refinery throwaway thickness of 0.14” [inch] is
reached. The carbon steel piping is currently running at temperatures
between 650 ° F on the pump suction line to 641 ° F on th e line just before E1113; the upper limit for carbon steel piping in this service is 550 ° F. A materials upgrade to 5 chrome would raise the upper limit to between
650

- 750 ° F. Additionally, the ABCR piping loop from the same sidecut
draw line off of the column to P

- 1148/A to E

- 1111 is also carbon steel and operates at the same temperatures, rendering the ABCR piping system to E

- 1111 susceptible to hot H2S corrosion as well. INFORMATION

Replace the existing #4 sidecut piping noted above from C

- 1100 thro ugh
P

- 1149/A to E1113 and P

- 1148/A to E

- 1111 (approximately 700’ [feet] of 12”, 10”, 8” and 6”piping, plus some 4”and 3” at the P

- 1149/P

- 1148 suction/discharge headers). Upgrade the pipe material from carbon steel

to 5 chrome. Recommendation

To implement this recommenda tion, Chevron initiated a n MOC in 2006 to replace the piping during the 2007 Turnaround

. However, the MOC supporting documents had a narrowed scope to only replace the section of piping from P

- 1149/A pumps to the E

- 1113 heat exchanger
because Chevron red uced the work scope during the 2007 turnaround planning process. The
D e scription of C hange in the MOC stated:

Existing line is carbon steel in a hot service that operates in the range
where high temperature sulf a dation [sic] occurs. The line has been ut i inspected and found to be nearing tmin ii

Contradicting this D escription of C hange detailing a replacement of the entire 4

- sidecut piping circuit, the MOC S ummary R eview and attached documentation only authorized replace ment of the piping from the P

- 1149’s to E

- 1113. The MOC states: requiring replacement. Due to the higher temperature 9CR [9

- Chrome] would be the prefered [sic]
material.

i UT is an abbreviation used to indicate ultrasonic thickness testing inspection technique.
ii Tmin is an abbreviation used to indicate minimum required piping wall thickness.Chevron R ichmond Refinery Interim Investigation Report April 2013

43 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 4 S/C piping has been operating hotter in recent years. The hotter temperatures 550 ° F are in the high temperature sulfadation [sic] range. Additionally the section of 4 S/C piping from P

- 1149' s to E

- 1113 has been found to be nearing tmin.

The section of pipng [sic] from P

- 1149’s to E

- 1113 will be rep laced with 9 Cr [9

- Chrome] piping.

As a result, t he portion of the piping containing the 52

- inch component that failed on August 6 th remained in service. Although the recommendation was intended to more broadly apply inherently safer materials of construc tion, the final implementation by the MOC limited the application of this more corrosion resistant metallurgy. i

59. In 2007, the Chevron Richmond R efinery conducted training to teach employees about the importance of complying with the City of Richmond’s Industrial Safety Ordinance ( R ISO) Again, the inherently safer, more corrosion resistant, metallurgy was not implemented more broadly in crude unit high temperature service. Oth er examples are discussed abo ve in the section entitled Chevron Sulfidation Corrosion Inspection and Mitigation

.

ii inherent safety guidance

. The training states “we should always strive to implement inherently safer strategies to the greatest extent feasible

. ” However, Chevron did not regularly or rigorously iii apply inherently safer design strategies in opportunities including PHAs, MOCs, incident investigation recommendations, and during turnarounds

. iv

60. Chevron uses an inherently safer design checklist v

i As discussed earlier, only the sect ion of piping downstream of the pumps was replaced with 9

- Chrome. for PHAs to meet inherently safer systems analysis requirements of the RISO

. The checklist, provided by Contra Costa County , is intended to aid identification of opportunities to implement inherently safer design during the PHA

process. The checklist was intended to stimulate discussion and analysis of potential opportunities to impl ement inherently safer design

. Contra Costa County ’s guidance on the IST checklist states that some items may need to be reviewed by a team that is outside the PHA team in order to involve people with the required expertise. Chevron utilized the Contra Costa County inherently safer technologies checklist ( IST C hecklist ) during the 2009 crude unit PHA.

ii The RISO will be discussed in more detail in the Regulatory Oversight section below.
iii Chevron does not utilize inherent safety guidewords or checklists during the MOC or incident invest igation process. Inherently safer guidewords help direct the inherently safer review process. Examples of guidewords include minimization, substitution, moderation, and simplification. These words may be applied to materials, product inventory, process controls, process piping, and siting, among others. See Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes

– A Life Cycle Approach.” 2 nd ed., Table 8.3, 2009.
iv As stated in the Regulatory Oversight section below, Chevron i s only required to conduct inherently safer design strategies during PHAs and for the construction of new processes.

v Contra Costa County’s guidance document entitled “Attachment C: Inherently Safer Systems Checklist” is provided as a tool for faciliti es to utilize during the PHA process. The actual use of the checklist is not required. See http://cchealth.org/hazmat/pdf/iso/attachment_c.pdf (accessed April 17, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

44 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD However, only three permissively worded i inherently safer system recommendations were made

, none of which addressed sulfidation corrosion or piping metall urgy

. In addition, Chevron performed the checklist analysis using the same individuals who conducted the PHA despite Contra Costa County ’s guidance to involve other perso nnel with additional expertise. Performing a superficial analysis, Chevron failed to adequately consider inherently safer system s like improved metallurgy for corrosion resistan ce

. For instance, the checklist prompted: “Use
corrosion resistant material?” In response, Chevron stated that “vessel specifications and piping
classifications include a conservative wall thickness and an appropriate corrosion allowance for
each service .” No mention is given to improving metallurgy to reduce corrosion. There is also no documented analysis regarding potential materials with enhanced corrosion re sistance. There was no documentation of the inherently safer technologies analysis, and no inherently safer
alternatives were documented. The checklist as applied by Chevron was a “check

- the

- box”
exercise. Chevron Richmond PHAs were thus not an effective m eans of driving inherent safety. The table below gives a sample of the IST checklist questions along with the associated Chevron

response s

. ii

Contra Costa County Checklist Question Chevron IST Analysis

Use Corrosion resistant materials? Vessel specifications and piping classifications
include a conservative wall thickness and an appropriate corrosion allowance for each service. Use smallest diameter piping? Piping sizes are the smallest possible for the capacity
of the unit.
Substitute less hazardous raw materials? Raw materials in use are of minimal hazard.

Dilute hazardous raw materials? Raw materials currently dilute where applicable.

Minimize off

- site impacts? #4 Crude Unit is located at a distance from public

areas

. Easy operation of valves designed to prevent
inadvertent error? In general, valves are arranged in a logical manner.

Increasing wall strength? Piping classifications include a conservative wall thickness and an appropriate corrosion allowance for
each service.

61. Contra Costa County inspected the Chevron Richmond Refine ry in 2011 , auditing Chevron’s
im plementation of the county’s inherently safer systems analysis requirements in the PHA

process. The inspectors determined that Chevron’s PHAs “follows the requirements specified by ... ISS [inherent safety systems] guidelines

. ” This approval by Contra Costa County

i All began with “consider” and two began with “consider evaluating” which does not require any action by Chevron.
ii The comprehensive list of IST checklist questions and Chevron’s corresponding answers are provided separately on the CSB website.Chevron R ichmond Refinery Interim Investigation Report April 2013

45 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD conveyed to Chevron that the regulator considered that Chevron’s minimal analysis of opportunities to implement inherently safer design , its “c heck

- the

- box” exercise, was sufficient.

62. Effectively implementing inherently safer technology provides an opportunity for preventing major che mical incidents. The August 6, 2012

, incident at Chevron and other incidents 43

63. It is essential that MOCs incorporate haz a rd analyse s and the assessment of opportunities to implement inherently safer system s

. This process can be assisted through the use of guidewords to trigger the thought process. CCPS states that “by including inherent safety guidewords in a management of change program, the MOC protocol recognizes inherent safety as both a driving
force for

- an d as an opportunity during

- implementation.” throughout the refining industry hi ghlight the difficulty in preventing failure caused by
sulfidation corrosion in low silicon carbon steel piping solely through inspection , a procedural safeguard that is low on the hierarchy of controls

. Using inherently safer design concepts to
avoid iss ues such as variation in corrosion rate in carbon steel piping due to hard

- to

- determine
silicon content will reduce future similar failures in refineries. Chevron and other process plants’ implementation of inherently safer systems to the greatest extent feasible would provide a higher degree of protection from incidents like the one that occurred on August 6, 2012

.

44

64. Layer of Protection Analysis (LOPA) is a well

- recognized hazard analysis methodology that is intended to determine if a sufficient number of safeguards or layers of protection exist to protect against a parti cular hazard or accident scenario

. 45 As the potential consequence of a particular scenario increases, the number of safeguards or protection layers must increase to reduce the risk of the scenario to what is considered an acceptable or tolerable level. 46 L OPA can be used to help an organization decide if the risk of a scenario or hazard has been reduced to a level that is “as low as reasonably practicable” (ALARP). 47 ALARP is a risk reduction goal, where risk
reduction efforts are continued until the increm ental effort to further reduce risk becomes grossly disproportionate to the level of additional risk reduction

. 48 By rigorously reviewing accident or hazard scenarios, evaluating the potential consequence of the scenario, and identifying the safeguards or layers of protection necessary to drive risk to as low as reasonably practicable, LOPA becomes an effective organizational tool for implementing a Process Safety Management ( PSM ) mechanical integrity program. 49 LOPA also helps an organization decide which safeguards to focus on during operation, maintenance, and training. i

, 50 In addition, the LOPA methodology includes provisions allow ing an organization to determine the availability ii and
effectiveness of a saf eguard or layer of protection in reducing the risk of a potential scenario. 51

i Chevron is a member of CCPS and peer

- reviewed the CCPS LOPA publication. See Center for Chemical Process Safety (CCPS). “Layer of Protection Analysis

– Simplified P rocess Risk Assessment,” page xiv, 2001.

ii The probability that a system will be able to p erform its designated function when required for use. Another term frequently used is Probability of Failure on Demand (PFD). Availability = 1

- PFD. See Center for Chemical Process Safety (CCPS), “ Guidelines for Safe Automation of Chemical Processes ,” pa ge XIX, 1993

.Chevron R ichmond Refinery Interim Investigation Report April 2013

46 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Regulatory Oversight

65. The Contra Costa County Industrial Safety Ordinance ( ISO ) requires that regulated faciliti es i

66. The purpose of the ISO is to “prevent accidental release of hazardous chemicals; improve accident prevention by soliciting participation from industry and the community; require industry to submit a Safety Plan; and conduct audits of the plan and inspections of the industrial plants.” within the county implement sa fety programs to prevent chemical incidents

. Since the ISO took
effect in January 1999

, Contra Costa County has continued to make improve ments to the implementation of the prevention program ’s elements

.

52

67. Although the City of Ric hmond is located in Contra Costa County

, the c ounty does not have jurisdiction over industrial facilities located within the city limits

. Thus, the ISO is not enforceable with in the City of Richmond

. On December 18, 2001, t he City of Richmond adopted its own i ndustrial safety ord inance ( RISO )

, based on the ISO

. ii

, 53 The RISO covers the two facilities located within the City of Richmond: Chevron and General Chemical West
Richmond Works. 54 Pursuant to an agreement between the two parties, Contra Costa County inspects the se two facilities and implements the RISO for the City of Richmond

. 55

68. T he ISO and R ISO contain identical provisions that address the use of inherent safety concepts.
Each define s “ inherently safer systems ” as “feasible alternative equipment, processes, ma terials, lay

- outs and procedures meant to eliminate, minimize, or reduce the risk of a major chemical accident or release by modifying a process rather than adding external layers of protection. ” 56

For all covered processes, the stationary source shall consider the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis and in the design and review of new processes and facilities. The stationary source shall select and implement inherently safer systems to the greatest extent feasible. If a stationary source concludes that an inherently safer system is not feasible, the basis for this conclusion shall be documented in meaningful
de tail

. Both regulations also require that:

57

i The ISO applies to oil refineries and chemical plants within the county jurisdiction that are required to submit a Risk Management Plan to EPA and are program level 3 stationary sources as defined by the California Accidental Release Prevention (CalARP) Progra m. There are seven facilities covered by the ISO, five of which are refineries. See http://cchealth.org/hazmat/iso/ (accessed April 17, 2013).
ii At the time of the August 6 th incident, the RISO did not include amendments made to the ISO in 2006. The 2006 amendments required an expansion of human factors programs, expanded management of organizational change reviews, security vulnerability analyses, and safety culture assessme nts. These amendments were subsequently adopted by the City of Richmond in February 2013. See http://cchealth.org/hazmat/iso/ (accessed on April 9, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

47 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 69. The apparent intent of the ISO and RISO regulations is to require companies to evaluate their processes in order to identify opportunities to imple ment inherently safer systems. However

, t he plain language contained within these regulation s conflic ts wit h this intent. Both regulations contain the following permissive language: “the s tationary source shall consider the use of inherently safer systems... ” 58

70. The language within the ISO and RISO regulations also require s effective action to implement inherently safer systems “to the greatest extent feasible

. ” This language does not require companies to conduct a comprehensive analysis and implement inher ently safer systems even where feasib le

. It only requires such an analysis be considered

. The regulations allow companies to merely engage in an activity contemplating the potential use of inherently safer systems.

59 I f an inherently safer system is not implemented

, the regulations require that the basis for this decision be “documented in meaningful de tail.” 60 However, these regulations do not require documentation supporting the adequac y of existing “inherently safer” 61

71. The inherently safer systems requirements of the I SO and RISO are only trigg ered by the
conduct of a PHA or the construction of a new process. claims. Chevron’s compliance with the RISO is
indicat ive of this deficiency. In its inherently safer systems checklist, Chevron sim ply

conc luded that its systems were inherently safe r to the extent that no modificatio ns were necessary. However, the company offered no documentation to substantiate these claims. Had
the ISO and RISO regulations require d analysis of inherently safer sy stems regardless of what the site already had in place, Chevron may have implemented the inherently safer recommendations made by technical staff to replace the 4

- sidecut with an inherently safer metallurgy.

62

72. The Contra Costa County PHA guidance do cument presents fo ur categories of risk reduction : Rebuilds

, repairs , MOCs

, and the implementation of incident investigation corrective action s do not require the analysis and application of inherent ly sa fer systems

.

i
inherent, passive, active, and procedural (Figure 1 5 )

. ii I t states that all four categories shoul d be used in the development of recommendations from process hazard analyse s. 63 It reiterates the CCPS statement that all may contribute to the overall safety of a process, but that inherent safety
is the most effective. 64 It goes on to state “The inherent and passive categories shoul d be implemented when feasible for new processes and facilities and used during the review of Inherently Safer Systems for existing processes if these processes could cause incidents that could result in a Major Chemical Accident or Release.” 65

i The guidance document uses CCPS definitions for the identified categories of risk reduction. This wordi n g in the guidance

ii Inherent risk reduction involves eliminating the hazard by using materials and process conditions that are non

hazardous. Passive risk reduction is defined as minimizing the hazard through process and equipment design features that reduce the frequency or consequence of the hazard without active functioning of any device. Active risk reduction i ncludes using controls, alarms, safety instrumented systems, and mitigation systems to detect and respond to process de viations from normal operation. Procedural risk reduction achieves the lowest level of risk reduction and involves using policies, operating procedures, training, administrative means, emergency response, and management approaches to prevent incidents and minimize the effects of an incident.Chevron R ichmond Refinery Interim Investigation Report April 2013

48 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD document demonstrate s the importance Contra Costa County places on risk reduction and prevention such as metallurgy upgrades; however, as a guidance document, it is non

- mandatory.

73. The California Division of Occupational Safety and Health (Cal / OSHA) has jurisdiction over emplo yee safety in California. 66 Cal/OSHA is a division of the California Department of
Industrial Relations and has operated a state plan industrial health and safety program since 1973 under a delegation from the U.S. Occupational Safety and Health Administration (OSHA)

. Cal / OSHA conducts inspections of California workplaces in response to industrial accident s , safety complaint s , or as part of an inspection program targeting specific in dustries. 67 Consideration of inherently safer processes is not currently a required component of any Cal/OSHA (or federal OSHA) standard or regulation. i

74. The State of California has promulgated process safety regulations similar to OSHA 68 for the prevention o r minimization of the consequences of the accidental release of acutely hazardous
chemicals. 69 These regulations require that covered employers perform a PHA to identify, evaluate and control hazards involved in the process using recognized methodologies. 70

75. California regulations, however, do not provide for a specific review of the effectiveness of the proposed safeguards to control the hazards identified in the PHA using recognized methodologies such as Layers of Protection Analysis (LOPA). 71

76. The Energy Institute, an industry technical working group Additionally , California regulations do not have any requirements for the use of inherent ly safe r systems analysis and the hierarchy of controls for establishing safeguards for identified process hazards. Cal / OSHA, like
federal OSHA, also does not require damage mechanism hazard reviews as part of the PHA

process.

ii organized in the United Kingdom (UK), with contributions from regulators including the UK’s Health and Safety Ex ecutive (HSE), iii as well as othe r entities, iv developed a document in 2008 v that provides guidance on damage mechanism hazard review s in the UK’s offshore petrochemical industry. The guidance
states that e ffective management of corrosion will contribute to equipment integrity and reduce risk from safety and environmental hazards. 72 In addition, d uring the design of a process, a corrosion review can be used to eliminate risks and achieve inherent safety. 73

i This is also the case for US EPA Risk Management Program and the California Accidental Release Prevention Program regulations. The guidance also

ii The Energy Institute is the leading chartered professional membership body supporting in divid uals and organizations across the energy industry. With a combined membership of over 13, 500 individuals and 300 companie s in 100 countries, it provides an independent focal point for the energy community and a powerful voice to engage business and in dustr y, government, academia and the public internationally. See http://www.energyinst.org/about

- us (accessed April 17, 2013).
iii HSE is an independent regulator that is tasked with securing the health, sa fety and welfare of workers within the UK. See http://www.hse.gov.uk/aboutus/index.htm (accessed April 17, 2013).
iv Chevron Energy Technology Company (ETC) was one of roughly 30 entities recognized in the guidance document as providing contributions to the institute that were “key to the development of this publication...”. See http://www.energyinstpubs.org.uk/pdfs/815.pdf (accessed April 17, 2013).

v Ibid.Chevron R ichmond Refinery Interim Investigation Report April 2013

49 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD notes that d amage mechanism hazard reviews should provide a struct ured framework for identifying risks associated with corrosion and developing suitable risk reduction measures. 74 These reviews should cover failure mechanisms including

, but not limited to corrosion, environmental cracking, erosion, and mechanical damage

, such as vibration induced fatigue. 75 Finally, this guidance states that a formal, documented quant itative and logic based assessment
should be used when conducting corrosion reviews

. 76

77. Under a rule issued by the U.S. Environmental Protection Agency (EPA)

, 77 a facility with a tank, drum, pipe, or other process i that contains an extremely hazardous toxic or flammable substance listed at 40 CFR §68.130 in an amount above the “threshold quantity” specified for that substance, is required to conduct a hazard as sessment as well as develop a prevention program and an emergency response program. These requirements are documented in a Risk Management Plan (RMP) that is submitted to EPA. Covered facilities must implement the RMP and update their RMPs periodically o r when certain changes occur. The goal of EPA’s Risk Management Program is to prevent accidental releases of substances that can cause serious harm to the public and the environment from short

- term exposures, and to mitigate the severity of
releases that do occur. 78

78. The EPA RMP program provisions build on the planning and preparedness groundwork laid by
the Emergency Planning and Community Right

- to

- Know Act of 1986 (EPCRA). EPCRA establishes requirements for federal, state, and local governments, as well as industry, regarding emergency planning and “Community Right

- to

- Know” reporting on hazardous toxic chemicals. EPCRA “help[s] increase the public’s knowledge and access to information on chemicals at individual facilities, their uses, and releases into the environment.” 79 According to the U.S.
EPA’s Chemical Emergency Preparedness and Prevention Office, ii

Both EPCRA and the CAA [Clean Air Act] section 112(r) Risk Management Progra m encourage communication between facilities and the surrounding communities about chemical safety and chemical risks. Regulatory requirements, by themselves, will not guarantee safety from
chemical accidents. Information about hazards in a community wil l allow local emergency officials and the public to work with industry to prevent accidents. transparency between industry and the public will improve community safety:

80

i “Process” means “any activity involving a regulated substance including any use, storage, manufacturing, handling,

or on

- site movement of such substa nces, or combination of these activities...” 40 CFR §68.3 (1997).
ii In 2004, the U.S. EPA’s Chemical Emergency Preparedness and Prevention Office was merged with the Superfund Emergency Response Program and Oil Spill Prevention Program to form the Office o f Emergency Management, or OEM. OEM works with other EPA partners, federal, state, and local agencies, and industry to prevent accidents and maintain and provide superb response capabilities. See http://www. epa.gov/oem/about.htm (accessed April 17, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

50 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD The CCPS also notes that governments and advocacy organizations have been successful in driving performance improvement by using public disclosure to make safety information available to the public. 81

79. Under the RMP program’s hazard assessment requirement, a facility must prepare a worst

- case release scenario analysis 82 and complete a five

- year accident history. 83 A covered facility must also develop and implement an emergency response program that includes procedures for informing the public and local agencies about accidental releases and procedures and measures for emergency response after an accidental release. 84

80. Workforce involvement is a key element of process safety and effective chemical accident prevention. In the Center for Chemical Process Safety publication, G uidelines for Risk Based Process Safety

, it list s workforce involvement as one of 20 essential management systems

neces sary to reduce process safety risks and prevent chemical accidents. Officials and the public, including local

em ergency planning committees (LEPCs) can use this information to understand the chemical hazards in the community and then work with industry to address and mitigate those
hazards. With both EPCRA and the Risk Management Program, the regulatory purpose and
substa ntive provisions emphasize the importance of transparency, sharing of process safety data, and public participation to prevent chemical accidents. The CSB notes that post

- incident

, during
the decision

- making related to piping repairs to the c rude u nit, th e public, worker representatives, regulators

, and governmental bodies played a key role driving transparency, accountability

, and improved risk reduction.

85

...workers are potentially the most knowledgeable people with respect to the day

- to

- day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their unique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise. CCPS states that :

86

This CCPS publication discusses general areas of workforce involve ment in risk assessments, inspections, audits, and performance reviews. The CCPS notes that participation leads to empowerment, management responsiveness

, and process safety performance improvement

. 87

The OSHA PSM Standard emphasizes the importance of pa rticipation by workers and their representatives . It requir es employers to develop a written plan of action, consult with employees

, and make available all process safety information. 88 In previous investigation reports, the CSB has identified that workers and their representatives play a very important role
in major incident prevention. For example, i n the BP Texas City oil refinery investigation report, the CSB recommend ed t hat BP and the United Steelworkers International Unio n (USW) establish a joint program to r eport incident s and near misses , and to ensure that
recommendations made during investigations were implemented. The CSB also recommendedChevron R ichmond Refinery Interim Investigation Report April 2013

51 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD that API and the USW work together to develop a safety standard addressing lead ing and lagging process safety indicators. i

81. In July 2012, the CSB held a public hearing on process safety indicators ii to explore how companies and regulators use process safety metrics to manage risks and drive continuous safety improvements. During this hearing t he CSB stated that

, following the 2005 BP Texas City accident, both the CSB and Baker Panel iii

82. Process safety management systems are critical for reducing process safety incidents. Process safety indicators are a significant element of these systems. Indicators measure the strengths and
weaknesses of process safety management systems
, to achiev e and maintain safe and reliable operations

. reports noted the lack of focus by BP on process safety and inadequate performance measurement indicators. The CSB also noted that one goal of

process s afety indicators i s to drive continuous process safety improvement, and that regulators
can utilize these indicators to focus inspections, audits, and investigations.

89 Properly selected and managed indicators will identify the successes and point out
the flaws of the system. 90

83. In 2008

, the CCPS published a guidance document for the development of leading iv and lagging v process safety indica tors to assist industry in avoiding catastrophic chemical incidents. 91 While process safety indicators are an important tool for major accident prevention, the simpl e activity
of identifying and recording process safety metrics will not drive process safet y improvement

. CCPS notes that these metrics must be “collected, analyzed, communicated, understood, and acted upon .” 92

84. The UK H SE has published a guidance document to help chemical and major hazard industries develop process safety indicators. HSE stat es that:

Most systems and procedures deteriorate over time, and system failures discovered following a major incident frequently surprise senior managers, who sincerely believed that the controls were functioning as designed. Used effectively, process

i Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc...
ii See http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed April 17, 2013).
iii See http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pd fs/Baker_panel_report.pdf (accessed April 12, 2013).
iv Leading indicators are measurements that predict future performance to ensure that sa fety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics , Page 20. 2010.

v Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety me tric. See Center for Chemical Process Safety (CCPS), “ Guidelines for Process Safety Metrics ,” 2010; Page 20.Chevron R ichmond Refinery Interim Investigation Report April 2013

52 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD safety indicators can provide an ea rly warning, before catastrophic failure, that critical controls have deteriorated to an unacceptable level. 93

85. The public can pl ay an important role in monitoring safety management systems

. In its recent guidelines, the CCPS promoted the sharing of process safety indicators with the public :

Sharing performance metrics and results broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics and performan ce public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating

process safety successes also demonstrates to employees and the public that positive change can be, and are being, made within an organization. 94Chevron R ichmond Refinery Interim Investigation Report April 2013

53 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Recommendations

Under 42 U.S.C. 7412(r)(6)(C)(ii), the U.S. Chemical Safety and Hazard Investigation Board is charg ed
with “recommending meas u res to reduce the likelihood or the consequences of incidental releases and proposing corrective steps to make chemical production, processing, handling and storage as safe and free
f rom risk of injury as possible .... ” The CSB ma kes recommendations based on the findings and conclusions of the investigation. Recommendations are made to parties that can affect change to prevent future incidents, which may include the company, contractors, industry organizations responsible for
deve loping good practice guidelines, regulatory bodies, and/or organizations that have the ability to broadly communicate lessons learned from the incident, such as trade associations or professional
societies.

Chevron U.S.A (Urgent)

2012

- 03

- I

- CA

- R1

At all Chevron U.S. refineries, engage a diverse team of qualified personnel to perform a documented damage mechanism hazard review

. This review shall be an integral part of the Process Hazard Analysis cycle and shall be conducted on all PSM

- covered proce ss piping circuits and process equipment

. The damage mechanism hazard review shall identify potential process damage mechanisms and consequences of failure, and shall ensure safeguards are in place to control hazards presented by those damage
mechanisms. Analyze and incorporate into this review applicable industry best practices

, Chevron Energy Technology Company findings and recommendations , and inherently safer systems to the greatest
extent feasible.

2012

- 03

- I

- CA

- R2

At all California Chevron U.S. refineries, r eport leading and lagging process safety indicators

, such as the
action item completion status of recommendations from damage mechanism hazard reviews, to the federal, state

, and local regulatory agencies that have chemical release prevention authority.Chevron R ichmond Refinery Interim Investigation Report April 2013

54 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Mayor and City Council, City of Richmond, California

2012

- 03

- I

- CA

- R 3

Revise the Industrial Safety Ordinance (ISO) to require that Process Hazard Analyses include
documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards
intended to control hazards will be effective. This process shall use established qualitative, quantitative,
and/or semi

- quantitative methods such as Layers of Protection Analysis (LOPA).

2012

- 03

- I

- CA

- R 4

Revise the Indus trial Safety Ordinance (ISO) to r equi re the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards

. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new proce ss es , process unit rebuilds, significant process repairs, and in the development of corrective actions from incident investigation recommendations.

2012

- 03

- I

- CA

- R5

Ensure the effective implementation of the damage mechanism hazard review program (2012

- 03

- I

- CA

R1 and 2012

- 03

- I

- CA

- R2), so that all necessary mechanical integrity work at the Chevron Richmond Refinery is identified and recommendations are completed in a timely way.Chevron R ichmond Refinery Interim Investigation Report April 2013

55 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD Board of Supervisors Contra Costa County , California

2012

- 03

- I

- CA

- R 6

Revise the Industrial Safety Ordinance (ISO) to require that Process Hazard Analyses include
documentation of the recognized methodologies, rationale and conclusions used to claim that safeguards
intended to control hazards will be effective. This process shall use established qualitative, quantitative,
and/or semi

- quantitative methods such as Layers of Protection Analysis (LOPA).

2012

- 03

- I

- CA

- R 7

Revise the Industrial Safety Ordinance (ISO) to r equi re the documented use of inherently safer systems anal ysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards . The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include requirements for inh erently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new process es , process unit rebuilds, significant process repairs, and in the development
of correct ive actions from incident investigation recommendations.

2012

- 03

- I

- CA

- R 8

Monitor and confirm the effective implementation of the damage mechanism hazard review program (2012

- 03

- I

- CA

- R1 and 2012

- 03

- I

- CA

- R2), so that all necessary mechanical integrity work a t the Chevron Richmond Refinery is identified and recommendations are completed in a timely way.Chevron R ichmond Refinery Interim Investigation Report April 2013

56 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD California State Legislature,
Governor of California

2012

- 03

- I

- CA

- R 9

Revise the California Code of Regulations, Title 8, Section 5189, Process Safety Management of Acutely
Hazardous Materials

, to require improvements to mechanical integrity and process hazard analysis programs for all California oil refineries

. These improvements shall include engag ing a diverse team of qualified personnel to perform a documented damage mechanism hazard review . This review shall be an integral part of the Process Hazard Analysis cycle and shall be conducted on all PSM

- covered process piping circuits and process equipment

. The damage mechanism hazard review shall ident ify potential process damage mechanisms and consequences of failure, and shall ensure safeguards are in place to
control hazards presented by those damage mechanisms. Require the a naly sis and incorporat ion of applicable industry best practices and inheren tly safety systems to the greatest extent feasible into this
review

.

2012

- 03

- I

- CA

- R 10

For all California oil refineries, identify and require the report ing of leading and lagging process safety
indicators

, such as the action item completion status of rec ommendations from damage mechanism hazard reviews, to state and local regulatory agencies that have chemical release prevention authority . These indicators shall be used to ensure that requireme nts described in 2012

- 03

- I

- CA

- R 9 are effective at improving mechanical integrity and process hazard analysis performance at all California oil refineries and preventing major chemical incidents.

2012

- 03

- I

- R 11

Establish a multi

- agency process safety regulatory program for all Californi a oil refineries to improve the public accountability, transparency

, and performance of chemical accident prevention and mechanical integrity programs. This program shall:

1. Establish a system to report to the regulator the recognized methodologies, finding s, conclusions and corrective actions related to refinery mechanical integrity inspection and repair work arising from Process Hazard Analyses, California oil refinery turnarounds and maintenance

- related shutdowns;
2. Require reporting of information such as damage mechanism hazard reviews, notice of upcoming
maintenance

- related shutdowns, records related to proposed and completed mechanical integrity work lists, and the technical rational e for any delay in work proposed but not yet completed;Chevron R ichmond Refinery Interim Investigation Report April 2013

57 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 3. Establish proce dures for greater workforce and public participation including the public reporting of information; and
4. Provide mechanisms for federal, state and local agency operational coordination, sharing of data (including safety indicator data), and joint accident prevention activities. The California Department of Industrial Relations will be designated as the lead state agency for establishing a repository of joint investigative and inspection data, coordinating the sharing of data and joint accident prevention a ctivities.

2012

- 03

- I

- CA

- R 1 2

Require that Process Hazard Analyses required under California Code of Regulations, Title 8, Section 5189 Section (e) include documentation of the recognized methodologies, rationale and conclusions used

to claim that safeguards intended to control hazards will be effective. This process shall use established qualitative, quantitative, and/or semi

- quantitative methods such as Layers of Protection Analysis (LOPA).

2012

- 03

- I

- CA

- R 1 3

Requi re the documented use of inherently safe r systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards

. The goal shall be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP)

. Include requir ements for inherently safer systems analysis to be automatically triggered for all Management of Change and Process Hazard Analysis reviews, prior to the construction of new process, process unit rebuil ds, significant process repairs and in the development of corrective actions from inciden t investigation
recommendations

.

2012

- 03

- I

- CA

- R1 4

M onitor and confirm the effective implementation of the damage mechanism hazard review program (2012

- 03

- I

- CA

- R 9 and 2012

- 03

- I

- CA

- R 10 ), so that all necessary mechanical int egrity work at all California Chevron Refineries is identified and recommendations are completed in a timely way.Chevron R ichmond Refinery Interim Investigation Report April 2013

58 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD The U

. S

. Environmental Protection Agency

2012

- 03

- I

- CA

- R 1 5

Jointly plan and conduct inspections with Cal/OSHA, California EPA and other st ate and local regulatory agencies with chemical accident prevention responsibilities to monitor the effective implementation of the damage mechanism hazard review and disclosure requirements under 2012

- 03

- I

- CA

- R 9 and R 10 above.

The Board of Supervisors , Contra Costa County , California , 2012

- 03

- I

- CA

- R 1 6 ; The Mayor and City Council, City of Richmond, California

, 2012

- 03

- I

- CA

- R 1 7 ; The California Air Quality Management Divisions, 2012

- 03

- I

- CA

- R 1 8 ; The U.S. Environmental Protection Agency, 2012

- 03

- I

- CA

- R 1 9 ; and The California Environmental Protection Agency, 2012

- 03

- I

- CA

- R 20 ;

Participate in the joint regulatory program described in recommendation 2012

- 03

- I

- CA

- R1 1

. This participation shall include contributing relevant data to the repository of investigation and inspection data created by the California Department of Industrial Relations and jointly coordinating activities

.Chevron R ichmond Refinery Interim Investigation Report April 2013

59 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Additional Issues Currently Under Investigation

The following se ction highlights additional issues which the CSB has identified to date in its investigation of the Chevron Richmond Refinery fire and major hydrocarbon release that occurred on August 6, 2012

. Thes e issues relate to the on going CSB investigation of the management and regulation of health and safety at refin eries

. T he CSB final report will make additional recommendations consistent with this interim report and will present additional detailed findings and analyses in a final r eport on the incident,
to be released later in 2013.



## Regulatory Oversight

The CSB noted in its BP Texas City (BPTC) Final Investigation Report (issued in March 2007) the importance of having a well

- resourced, competent regulator consisting of individuals with the necessary training, education, and experience to conduct planned comprehen sive and robust inspections of facilities with the goal of preventing catastrophic accidents. In a 1992 compliance directive i the federal Occupational Safety and Health Administration (OSHA) stated that the primary enforcement model for the Process Safety Management of Highly Hazardous Chemicals (PSM) standard would be planned, comprehensive, and resource

- intensive Program Quality Verification (PQV) inspections to help prevent catastrophic accidents. 95

Spurred in part by the CSB’s recommendations, OSHA i ssued the Petroleum Refinery Process Safety Management National Emphasis Program (NEP) on June 7, 2007. However, the CSB report noted that for the 10

- year per iod prior to the Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. Regular planned inspections appropriately emphasize the prevention of accidents tha t are potentially catastrophic. Issuing fines and prosecuting companies post

- incident are not acceptable substitute s for prevention. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by developing more highly trained and experienced inspectors to conduct more comprehensive inspections similar to those under OSHA’s PQV program at facilities presenting the greatest risk of a catastrophic accident.

ii The NEP was a federal program that established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard, 29 CFR §1910 .119. 96 Unlike the PQV approach to inspections, which “employs a broad, open

- ended inspection strategy and uses a more global approach to identify compliance deficiencies...,” 97 the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standar d...[which] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, interview employees, and verify implementation for specific processes, equipment, and procedures.” 98

i Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance S afety and Health Officers (CSHOs) for enforcing a new regulation. While the CSB called for an on going comprehensive inspection

ii Originally Directive Number CPL 03

- 00

- 004. Extended August 18, 2099 as Directive Number CPL 03

- 00

- 010 to allow more time to complete NEP inspections under the original CPL 03

- 00

- 004.Chevron R ichmond Refinery Interim Investigation Report April 2013

60 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD program, inspections being conducted pursuant to the NEP were terminated in 2011. T he CSB recommendation to OSHA remains Open

. i

OSHA State Plan States ii were strongly encouraged but not requir ed to implement the NEP. California’s Division of Occupational Safety and Health (Cal/OSHA) did not adopt the NEP “because of its dedicated
PSM Unit.” 99 Cal/OSHA informed the CSB that federal OSHA approved this decision in 2007. In lieu of conducting NEP inspections, Cal/OSHA ’s PSM Unit has conducted and continues to conduct a full range
of programmed, accident, complaint, and referral inspections of PSM

- covered facilities in the state of California pursuant to the California Labor Code, Title 8 regulatio ns, and Cal/OSHA’s Policy and Procedures (P&P) Manual C

- 17 “Process Safety Management

, ” iii

Between 2006 and August 6, 2012 , Cal/OSHA conducted three planned inspections of the Chevron
Richmond facility

, totaling only 150 inspector hours of effort

. None of these inspections resulted in
citations or fines. In contrast, a ccording to statistics provided by OSHA, federal NEP refinery inspections
conducted between 2007 and the end of 2011 lasted rou ghly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspectio n were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehe nsiveness between the planned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA an d other OSHA
State Plan States. to ensure these facilities are complying with PSM requirements.

The safety case is a rigorous prescriptive and goal

- s etting regulatory regime that is highlighted by its adaptability and requirements for continuous improvements in risk reduction for hig h hazard industrial
facilities. The approach is used widely overseas but is not used currently for U.S. process industri es. The CSB is currently examining whether the implementation of the safety case regime c ould be a more effective regulatory tool for Cal/OSHA in its effort to ensure that California refineries are identifying and controlling hazards and ultimately drivin g risk to as low as reasonably practicable (ALARP)

. Utilizing the safety case requires effective implementation by an independent, competent, well

- funded regulator. Experience and competence of the regulator in technical areas such as chemical engineeri ng, human factors, and process safety are necessary to provide effective auditing and regulatory oversight for

prev ention. To ensure effective implementation of the safety case, industry standards and guidelines must be rigorous and up

- to

- date as well. T he CSB notes that relevant and applicable industry standards and guidelines

– such as API RP 939

- C

– currently contain voluntary and permissive language. The CSB will be examining the need for more effective good practice standards and guidelines containi ng the necessary requirements to p revent catastrophic accidents.

i Open

- Awaiting Response or Evaluation/Approval of Response (O

- ARE/AR)

- The recipient has not submitted a substantive response, or the evaluation by CSB staff of a response is pending, or the Board has not yet acted on staff recommendation of status

. ii Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs , referred to informally as an OSHA State Plan

. OSHA approves and monitors State plans and provides up to 50 perc ent of an approved plan's operating costs.
iii Issued June 6, 1994. Revised August 1, 1994 and May 19, 2007.Chevron R ichmond Refinery Interim Investigation Report April 2013

61 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD In addition to the issues discussed above, the CSB will also be examining the need for the reporting of leading and lagging process safety indicators to the regulator; the regulator’s effective use of these process safety indicators ; workforce and stakeholder involvement in regulato ry oversight of refineries;
and the thoroughness of Contra Costa County ’ s safety audi ting of the Chevron facility.



## Emergency Planning and Reporting

Accordin g to information provided by Contra Costa Emergency Medical Services, 15,213 individuals sought emergency medical attention between August 6 and August 23, 2012, due to the Chevron refinery major hydrocarbon release and fire.

CSB Investigation Team membe rs visited local hospitals the week of the incident to better understand the impact on the surrounding community. Officials at Doctor’s Medical Center (DMC) in San Pablo, California, informed the CSB that in the days following the incident they were inund ated with emergency room visits and found it difficult to handle the influx due to a lack of funding and staffing. Officials at both DMC and Kaiser Permanente Hospital (KP) in Richmond told the CSB that they lacked specific knowledge of the chemicals rele ased as a result of the incident, complicating efforts to evaluate and treat
individuals.

The California Code of Regulations (CCR) requires that owners and operators of hazardous waste facilities make “arrangements to familiarize local hospitals with the properties of hazardous waste handled at the facility and the types of injuries or illnesses which could results from fires, explosions, or releases at the facility.” 100

Following the incident, Contra Costa County’s Community Warning System (CWS) notified the surrounding community of a hazardous mater ial incident and ordered a s helter

- in

- p lace (SIP). The CWS uses sirens, the news media, and phone calls to residents in order to initiate the SIP. Contra Costa County issued the SIP on August 6, 2012

, at 6:38 pm for the cities of Richmond, San Pablo, and North Richmond, California, and lifted the SIP later that evening at 11:12 pm. However, the CSB has learned that some phone calls notifying residents of the SIP did not occur until over four hours after the release. The CSB is currently evaluating ways to ensure that hospitals have the
information nec essary to properly evaluate and treat individuals that may be exposed to releases from facilities in Contra Costa County.

It is essential that responders, comm unity residents

, and hospitals in the areas surrounding industrial
facilities be aware of what hazardous material s exist at these facilities, what specific chemicals are released into the community in the event of an incident, and what is known about the p otential acute and chronic health impacts. The CSB will be analyzing ways to strengthen current regulations and policies to ensure there is proper emergency planning and reporting for industrial facilities in Contra Costa County
and the s tate of Californi a.Chevron R ichmond Refinery Interim Investigation Report April 2013

62 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## Emergency Response

OSHA provides guidanc e on emergency response in its Hazardous Waste Op erations and Emergency Response s tandard , known as HAZWOPER, under 29 CFR §1910.120 (p) and (q). Under 29 CFR §1910.120(q)(6), t he HAZWOPER standard contains requirements for training and qualification of all individuals involved in emergency response related to their roles and responsibilities.

Good safety practice dictates that i ndividuals responding to emergencies should have the tec hnical knowledge to give input into shutdown decisions, set up an incident command structure, establish boundary limits

, and evaluate the “hot zone.” Access to the hot zone must be strictly limited to personnel with higher degrees of specific training, experience

, and appropriat e personal protective equipment ; all
others must be removed to a safe location away from chemical hazards. Hot zone boundaries must be
established to anticipate the possible escalation of releases and the positioning of firefighting e quipment
such as fire trucks.

The CSB will be looking at the sufficiency of regulatory requirements, industry standards

, and good practices

, in addition to evaluating emergency response decision

- making following the leak and subsequent pipe rupture (including the training and qualification of responders) to determine whether improve ments are needed in th ese area s

. 

## Safety Culture

The Center for Chemical Process Safety (CCPS) defines process safety culture as the “combination of group values and behaviors that determines the ma nner in which process safety is managed.” 101

The CSB notes that on August 6, 2012

, following discovery of the leak on the 4

- sidecut piping

, Chevron hoped to forestall a shutdown by installing a leak repair clamp

. As the CSB noted in its BP Texas City Report, safety culture can be influenced by management changes, historical events, and economic pressures. After reviewing evidence and decisions made relating to materials of construction and mechanical integrity within the crude unit at the Chevron refinery, as well

as the response to the leak on August 6, 2012 , the CSB has determined that issues rel ating to safety
culture are relevant to this incident. The CSB will examine the Chevron Richmond R efinery’s approach to safety, its safety culture and any organizational deficiencies, to determine how to best prevent future
incidents.

i Chevron’s mechanical integrity management system has not been fully successful in detecting and replacing deteriora ted piping components prior to failure, resulting in the company’s frequent use of leak repair clamps ii

i Chevron’s leak repair clamp vendor was called out to the scene of the leak to help determine potential clamping options. to externally stop process fluid leaks. Chevron’s reliance on such clamps to mitigate process piping component leaks
identifies serious questions about its mechanical integrity program. The CSB determined that Chevron

ii Leak repair clamps are mechanical devices designed and installed to stop a leak from a piping component such as piping, valves, flanges, and instrumentation. These devices are typically intended to provide a temporary repair while a process continues operation until a plant sh utdown takes place and a permanent repair can be made.Chevron R ichmond Refinery Interim Investigation Report April 2013

63 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD has more than 100 clamps on hydrocarbon and other process piping components at the Richmond refinery. The leak repair clamp is typically relied upon to prevent further leaking until the ne xt unit turnaround, when the deteriorated piping component can be repaired. However, Cal/OSHA citations following the August 6, 2012

, fire in the crude unit identified that Chevro n has not always replaced these clamps during unit turnarounds and these dev ices then remain in service significantly longer than originally intended. The CSB determined that Chevron has leak repair clamps in place on piping components containing hazardous flammable process fluids including applications where the pro cess material is above the auto ignition temperature. Some of these leak repair clamp applications are in locations where a permanent repair would not have required a unit shutdown. The CSB will further
evaluate the frequent use of leak repair clamps by Chevron and th e potential that the deviance of a weak mechanical integrity management system has been normalized

. i

i Normalization of deviance is a long

- term phenomenon in which individuals or work teams gradually accept a lower standard of performance until the lower standard becomes the norm. It is typically the result of conditions slowly changing and eroding over t ime. See Center for Chemical Process Safety (CCPS), Recognizing Catastrophic Incident Warning Signs in the Process Industries , Page 4. 2012.Chevron R ichmond Refinery Interim Investigation Report April 2013

64 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD BY THE

U.S. Chemical Safety and Hazard Investigation Board

Rafael Moure

- Eraso
Chair

Mark Griffon
Member

Beth Rosenberg
Member

Date of Approval April __, 2013.Chevron R ichmond Refinery Interim Investigation Report April 2013

65 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

## References

1

. Chevron U.S.A. Inc. "30 Day Follow

- Up Notification Report." September 5th, 2012.

2 . KTVU roof cam footage. S ee http://www.ktvu.com/videos/news/ktvu

- timelapse

- exclusive

- timelapse

video

- of

- smoke/vdCJ7/ (accessed April 10, 2013)

.

3

. Anamet, Inc. "Metallurgical Eva luation of Samples from the Chevron U.S.A. Inc., Richmond #4 Crude Unit 8

- Inch and 12

- Inch 4

- Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for: The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013.

4 . API RP 939

- C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.” 1st ed., Section 4, May 2009.

5

. Ibid at Section 3.1.6.

6

. Ibid at Section 6.2.2.1.

7 . NACE International Task Group 176. "Overview of Sulf idic Corrosion in Petroleum Refining." NACE International Publication 34103. Item No. 24222, 2004.

8

. API RP 939

- C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.” 1st ed., May 2009.

9

. Ibid.

10 . ASTM Standard A53/A53M

- 12. "Standard Specification for Pipe, Steel, Black and Hot

- Dipped, Zinc

Coated, Welded and Seamless

. " 2012.

11

. Niccolls, E. H., J. M. Stankiewicz, J. E. McLaughlin, and K. Yamamoto. "High Temperature Sulfidation Corrosion in Refining." 17th Inter national Corrosion Congress. Las Vegas: NACE International, 2008.

12

. API RP 939

- C. "Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries.” 1st ed., Section 6.2.3.2, May 2009.

13 . API Publication 943. “High

- Temperature Crude Oil Corrosivity Studies.” September 1974.

14 . ASTM Standard A53/A53M

- 12. "Standard Specification for Pipe, Steel, Black and Hot

- Dipped, Zinc

Coated, Welded and Seamless." 2012.

15

. ASTM Standard A106/A106M

– 11

. "Standard Specification for Seamless Carbon Stee l Pipe for High

Temperature Service." 2011.

16 . API Specification 5L. "Specification for Line Pipe." 45th ed., December 2012.

17

. ASTM Standard A53/A53M

- 12. "Standard Specification for Pipe, Steel, Black and Hot

- Dipped, Zinc

Coated, Welded and Seamless." 2012.

18

. http://www.eia.gov/tools/faqs/faq.cfm?id=29&t=6 (accessed February 14, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

66 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 19

. Anamet, Inc. "Metallurgical Evaluation of Samples from the Chevron U.S.A. Inc., Richmond #4 Crude Unit 8

- Inch and 12

- Inch 4

- Sidecut Piping Involved in the August 6, 2012, Hydrocarbon Release and Fire." Prepared for: The Chemical Safety and Hazard Investigation Board (CSB), February 11, 2013.

20

. API RP 939

- C. "Guidelines for Avoiding Sulfidation (Sulfidic ) Corrosion Failures in Oil Refineries." 1st ed

. , Section 7.1.5, May 2009.

21

. Ibid.

22

. Ibid.

23

. Ibid.

24

. Ibid at Section 9.

25

. Ibid at Section 7.1.5.

26

. Ibid at Section 6.2.3.2.

27

. Ibid at Section 7.1.5.

28

. Ibid at Section 9.

29

. Ibid at Section 9.

30 . API RP 571. “Damage Mechanisms Affecting Fixed Equipment in the Refining Industry.” 2nd ed., April 2011.

31 . Center for Chemical Process Safety (CCPS). “Layer of Protection Analysis

– Simplified Process Risk Assessment.” 2001.

32 . Division of Occupati onal Safety and Health, State of California, Citation of Notification of Penalty

, Inspection Number 314331877, CSHO ID A0572, Citation 4 Item 1, January 30, 2013.

33

. http://www.opportunitycrudes.com/marketupdates/index.php?topics=opcrudetypes (accessed February 14, 2013).

34

. API RP 939

- C. “Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries." 1st ed., Section 4, May 2009.

35 . API 570. " Piping Inspection Code: In

- Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 4.3.1.2, November 2009.

36

. www.aiche.org/ccps/about (accessed February 14, 2013).

37

. www.aiche.org/ccps/community/members (accessed February 14, 2013).

38 . Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes

– A Life Cycle Approach.” 2nd ed., Section 2.2, 20 09.Chevron R ichmond Refinery Interim Investigation Report April 2013

67 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 39

. Ibid at Section 5.1.1.

40

. Ibid at Section 5.2.

41

. Ibid at Page 184.

42 . Kletz, Trevor, and Paul Amyotte. “Process Plants: A Handbook for Inherently Safer Design.” 2nd ed., Section 1.1, Page 14, 2010

.

43

. API RP 939

- C. “Guidelines for Avoiding Su lfidation (Sulfidic) Corrosion Failures in Oil Refineries." 1st ed

., May 2009.

44 . Center for Chemical Process Safety (CCPS). “Inherently Safer Chemical Processes

– A Life Cycle Approach.” 2nd ed., Page 21, 2009.

45

. Ibid at Page 11.

46

. Ibid.

47

. Ibid at Page 26.

48

. Ibid at Page 46.

49

. Ibid at Page 27.

50

. Ibid at Page 26.

51

. Ibid at Page 80

52

. http://cchealth.org/hazmat/iso/faq.php (accessed February 14, 2013).

53 . City of Richmond Municipal Code Chapter 6.43, RISO. December 18, 2001. http://www.ci.richmond.ca.us/archives/66/113%20N. S.%20amending%20Richmond%20Municipal %20Code%20Chapter%206.43%20to%20improve%20industrial%20safety

- conformed.pdf (accessed April 11, 2013).

54

. http://cchealth.org/hazmat/iso/ (accessed April 11, 2013).

55 . City o f Richmond Municipal Code Chapter 6.43, RISO. Section 6.43.060 “Administration” December 18, 2001. http://www.ci.richmond.ca.us/archives/66/113%20N.S.%20amending%20Richmond%20 Municipal%20Code%20Chapter%206.43%20to%20improve%20industrial%20safety

- conformed.pdf (accessed April 11, 2013).

56 . Contra Costa County, California, Ordinance Code. Title 4

– Health and Safety. Division 450

– Hazardous Materials and Wastes. Chapter 450

- 8: Risk Management. Section 450

- 8.014 “Definitions” (2010). http://library.municode.com/in dex.aspx?clientId=16286 (accessed February 15, 2013). See also City of Richmond Municipal Code §6.43.050(g) (February 5, 2013).

57

. Ibid at Section 450

- 8.016 subpart (d)(3) “Process Hazard Analysis/Action Items.” See also City of Richmond Municipal Code §6.43.090(d)(3) (February 5, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

68 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 58

. Ibid

.

59

. Ibid

.

60

. Ibid

.

61

. Ibid

.

62

. Ibid

.

63 . Contra Costa County Industrial Safety Ordinance Guidance Document. Section D: Process Hazard Analysis / Action Items. Subpart D.1.3. Process Hazard Analysis Recommendati ons and Mitigations. Published June 15, 2011. http://cchealth.org/hazmat/pdf/iso/section_d.pdf (accessed March 20, 2013).

64

. Ibid at Subpart D.1. Inherently Safer Systems.

65

. Ibid.

66

. http://www.dir.ca.gov/dosh/enforcementpage.htm (accessed February 15, 2013).

67

. Ibid.

68 . 29 CFR §1910.119

– Process Safety Management of Highly Hazardous Chemicals (2002).

69 . California Code of R egulations. Title 8. Section 5189

- Process Safety Management of Acutely Hazardous Materials http://www.dir.ca.gov/title8/5189.html (accessed February 15, 2013).

70

. Ibid at (e)(1).

71 . Layer of Protec tion Analysis: Simplified Process Risk Assessment. Center for Chemical Process Safety of the American Institute of Chemical Engineers. 2001.

72 . Energy Institute. “Guidance for Corrosion Management in Oil and Gas Production and Processing.” Section 1.1, Ma y 2008.

73

. Ibid at Section 4.2.

74

. Ibid.

75

. Ibid at Section 1.2.3.

76

. Ibid at Section 4 .3.

77 . 40 CFR Part 68, known as the “Chemical Accident Prevention Provisions.”

78 . U.S. Environmental Protection Agency, “General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68).” Page i. March 2009. http://www.epa.gov/oem/docs/chem/Intro_final.pdf (accessed April 3, 2013).

79

. http://www.epa.gov/oem/content/lawsregs/epcraover.htm (accessed April 3, 2013).Chevron R ichmond Refinery Interim Investigation Report April 2013

69 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 80 . Chemical Emergency Prep aredness and Prevention Office, “RMPs Are on the Way! How LEPCs and Other Local Agencies Can Include Information from Risk Management Plans in Their Ongoing Work.” November 1999. http://ww w.epa.gov/osweroe1/docs/chem/lepc

- rmp.pdf (accessed April 17, 2013).

81 . Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 103. 2010.

82 . 40 CFR §68.25

. 1999

.

83 . 40 CFR §68.42. 1999

.

84 . 40 CFR §68.95(a)(1) 1996.

85 . C enter for Chemical Process Safety (CCPS). “Guidelines for Risk Based Process Safety.” Page liv. 2007.

86

. Ibid at Page 124.

87

. Ibid at Page 125.

88 . 29 CFR §1910.119 (c) 2012

.

89

. Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metric s , Page 109

. 2010.

90

. Ibid.

91

. Process Safety Leading and Lagging Metrics ...You Don’t Improve What You Don’t Measure

, http://www.aiche.org/ccps/resources/overview/process

- safety

- metrics/recommended

- process

- safety

metrics (accessed April 12, 2013)

.

92

. Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 97. 2010

.

93

. Health and Safety Executi ve (HSE), Developing Process Safety Indicators a Step

- by

- Step Guide for Chemical and Major Hazard Industries, HSE Guidance Series/HSG Series, HSG254, Page 4. 2006

.

94

. Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics, Page 10 9. 2010

.

95 . OSHA Instruction CPL 02

- 02

- 045 (1992). Updated in 1994.

96 . CPL 03

- 00

- 004, Secti on VII. Federal Program Change. 2007

.

97

. Ibid at Section X(D)(1).

98

. Ibid

.

99 . Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety Management District Office. “Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012.”

100 . 22 CCR §66265.32(a)(4)(2004).Chevron R ichmond Refinery Interim Investigation Report April 2013

70 U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 101 . Center for Chemical Process Safety (CCPS). “Guidelines for Risk Based Process Safety.” 2007.